The Agent Skills Directory

[CREDENTIALS_UNSAFE]: A hardcoded API key was detected in the Java code examples provided in the reference material. Although the key is part of a "bad example" intended to demonstrate insecure practices, the presence of a live-format credential string (Stripe API key pattern) is a security risk.
File: references/814-regulations-iso-25010-engineering-examples.md
Evidence: private static final String API_KEY = "sk_live_51H8x...";
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from Java enterprise projects, including source code, configuration files, and operational logs, which presents a surface for indirect prompt injection. 1. Ingestion points: The workflow in SKILL.md and assets/questions/814-iso-25010-engineering-review-questionnaire.md requires the agent to read and process local project artifacts like Java source code, configuration files, and test results. 2. Boundary markers: The questionnaire includes instructions to redact sensitive information but does not provide automated delimiters or explicit system instructions to ignore malicious content within analyzed artifacts. 3. Capability inventory: The skill utilizes file-reading capabilities to perform extensive analysis across various system artifacts. 4. Sanitization: The workflow relies on manual identification and redaction of sensitive data by the agent as directed by the questionnaire guidelines.

814-regulations-iso-25010