The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The preview-zul.py script downloads a binary helper, zk-preview-launcher.jar, from a known repository on GitHub (zkoss/zkidea). This download is secured by hardcoded SHA-256 digest verification (LAUNCHER_SHA256) before the JAR is executed.
[COMMAND_EXECUTION]: The skill uses subprocess.run and subprocess.Popen in its scripts (validate-zul.py, preview-zul.py, detect-pattern.py) to invoke standard development tools such as mvn, gradle, and uv for build environment resolution and dependency management.
[DATA_EXFILTRATION]: Scripts include a telemetry function that sends anonymous usage data (limited to skill name and version) to https://www.zkoss.org/api/track. This behavior can be disabled using environment variables like DO_NOT_TRACK=1.
[DYNAMIC_EXECUTION]: The skill provides a --run-controllers flag in preview-zul.py that allows the agent to execute project-specific Java controllers (Composers and ViewModels). This is used for rendering model-driven pages. The instructions explicitly warn the agent to only use this flag when it authored the controller or has verified the code.
[INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface as it reads and parses user-provided ZUL files. While it uses standard XML parsing, the content of these files influences the agent's context during the 'Requirements Clarification' and 'Validation' steps.

zul-writer