The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run Maven commands such as ./mvnw validate to verify the project state and mvn wrapper:wrapper to install build tools if missing. These are standard operations for Maven projects.
[EXTERNAL_DOWNLOADS]: The skill configures several standard Maven plugins (e.g., JaCoCo, Spotless, Jib) which are downloaded from established public registries like Maven Central during the build process. These sources are considered well-known and reputable.
[PROMPT_INJECTION]: The skill employs an interactive question-based workflow to gather project details from the user, which are then used to generate configuration. This creates a surface for potential indirect prompt injection via user-supplied data.
Ingestion points: Responses provided by the user to the interactive questions in SKILL.md.
Boundary markers: None. The skill does not specify delimiters for user-provided values when updating the pom.xml file.
Capability inventory: The skill allows for file writing to pom.xml and PMD rulesets, and execution of shell commands through the Maven CLI.
Sanitization: No explicit instructions for sanitizing user inputs are provided in the skill logic, relying on the agent's internal safety filters.

112-java-maven-plugins