The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill accepts a user-provided version string (<VER>) which is interpolated directly into shell commands used by the Bash tool.
Ingestion points: The agent prompts the user for a target Gradle version string.
Boundary markers: There are no specific boundary markers or validation rules defined for the input; the agent is instructed to use the provided version string "verbatim".
Capability inventory: The skill uses the Bash tool to execute curl for fetching checksums and ./gradlew for regenerating the wrapper and running build tasks.
Sanitization: The instructions lack sanitization or validation logic to ensure the provided version string does not contain shell metacharacters that could lead to command injection.
[EXTERNAL_DOWNLOADS]: The skill fetches Gradle distribution checksums and ZIP files from external sources.
Evidence: Fetches from https://services.gradle.org/distributions/gradle-<VER>-bin.zip.sha256 and https://cache-redirector.jetbrains.com/services.gradle.org/distributions/gradle-<VER>-bin.zip.
Context: These sources are well-known technology services (Gradle) or official vendor resources (JetBrains).
[COMMAND_EXECUTION]: The skill performs several automated shell operations to facilitate the upgrade process.
Evidence: Executes ./gradlew wrapper, ./scripts/update-verification-metadata.sh, and various build lifecycle tasks like publish, testClasses, and functionalTest.
Evidence: Uses grep and echo to modify local.properties for build configuration purposes.

build-bump-gradle-version