The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a Python script (scripts/inspect-project.py) designed to scan local project files for publication readiness and potential security risks. It is executed via a standard shell command as part of the user-guided workflow.
[DATA_EXPOSURE]: The skill provides extensive guidance on avoiding credential exposure. It explicitly warns against hardcoding secrets, recommends using environment variables/secret managers, and includes a 'redaction test' to verify that secrets do not appear in build logs or reports.
[OBFUSCATION]: The skill correctly identifies that the Authorization: Bearer header for the Sonatype API requires a Base64-encoded token and provides clear instructions on how to handle this safely in memory without logging the values.
[INDIRECT_PROMPT_INJECTION]: The skill has a low attack surface for indirect injection. While it processes project metadata (POM files, build scripts), it includes a structured 'Release Report' asset and detailed validation steps that require human review of the generated output before any external action is taken.
[CREDENTIALS_SAFE]: The skill demonstrates best practices for credential management. It guides users to generate Sonatype Portal tokens, store them in secret managers, and use standard injection methods (Maven settings.xml, Gradle properties) rather than hardcoding. The inspect-project.py script specifically looks for and flags literal secrets in configuration files.

maven-central-publishing