The Agent Skills Directory

[SAFE]: The skill explicitly instructs the agent to maintain security boundaries by redacting logs, managing secrets externally, and following least-privilege principles for authorization.
[SAFE]: Guidance is provided to prevent remote code execution by strictly controlling deserialization (allowlisting types) and avoiding unsafe framework configurations.
[SAFE]: The 'Project Grounding' protocol ensures the agent verifies the build root, toolchains, and effective authority before performing edits, preventing unintended system changes.
[INDIRECT_PROMPT_INJECTION]: The skill handles untrusted external data such as OpenAPI YAMLs and repository manifests.
Ingestion points: OpenAPI YAML contracts, Maven/Gradle manifests, and existing project source code.
Boundary markers: Mandatory validation of external contracts using generic parsers and establishing a 'Grounding Record' to verify authorities.
Capability inventory: Source code modification, build tool execution (Maven/Gradle), and integration testing.
Sanitization: Focuses on input validation, DTO separation, and strict bounds on data collection/deserialization. (Assessed as SAFE due to strong defensive instructions).

dev-java