Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add full-stack-skills/java-skills --skill maven-multi-branch-license-gate-hardeninggit clone --depth 1 https://github.com/full-stack-skills/java-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/full-stack-skills/java-skills/maven-multi-branch-license-gate-hardening)<a href="https://agentmods.dev/skills/full-stack-skills/java-skills/maven-multi-branch-license-gate-hardening"><img src="https://agentmods.dev/badge/skills/full-stack-skills/java-skills/maven-multi-branch-license-gate-hardening/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/full-stack-skills/java-skills/maven-multi-branch-license-gate-hardening"><img src="https://agentmods.dev/badge/skills/full-stack-skills/java-skills/maven-multi-branch-license-gate-hardening.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.02524 |
| Opus 5 | $0.00022 | $0.01262 |
| Sonnet 5 | $0.00009 | $0.00505 |
| Haiku 4.5 | $0.00004 | $0.00252 |
Grade A, and why
maven-multi-branch-license-gate-hardening scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Multi-branch License Gate Hardening
核心原则
把每条维护分支视为独立发布线。只有同一分支最终 SHA 上的许可证、SBOM、完整 Reactor、远端 SHA 与必需 CI 全部闭合，才可声明该分支通过；只有所有目标分支通过，才可声明整体完成。
本 Skill 面向 Maven 多分支发布维护者、发布工程师和审计人员。它不替代项目自己的 JDK/Maven/POM 契约、许可证政策或 CI 必需检查配置。
快速开始
可直接提出：
- “审计这三条维护分支的 license gate，并给出缺口矩阵。”
- “检查 SBOM、Reactor、push 与 CI 证据能否闭合到同一 SHA。”
- “这个临时端口冲突后的模块重跑，能否作为完整 Reactor 证据？”
先读取项目指令、现有计划/规格和每条分支的工具链契约，再建立一行一个分支的证据矩阵。用户只要求分析时保持只读；commit、push、重跑 CI 或修改许可证配置都需要处于明确授权范围。
能力边界
擅长
- 审计多条维护分支的许可证来源证据、选择表、排除表和生成报告。
- 验证 CycloneDX/SPDX SBOM 与实际依赖图、最终提交和发布范围一致。
- 区分完整 Maven Reactor、目标模块复验、
-rf恢复执行和 CI 等价验证。 - 核对本地 HEAD、tracking ref、远端 SHA 与该 SHA 触发的必需 CI。
需要素材
- 分支/工作树清单，以及每条线规定的 JDK、Maven/Wrapper 和构建命令。
- 项目许可证政策、SBOM 配置、必需 CI 名称及授权的变更/推送范围。
- 命令日志、报告路径、远端 SHA 或 CI run/job 标识；缺失时先输出
unknown缺口，不猜测。
超出范围
- 不把法律判断伪装成工程结论；许可证兼容性存在争议时转交法务或项目治理者。
- 不自动选择许可证、伪造证据 URL、放宽必需 CI，或把安全扫描
skipped写成passed。 - 不在未经授权时创建/切换分支、改写历史、commit、push、重跑或取消 CI。
工作流
1. 冻结范围与分支契约
对每条线记录：仓库根、工作树、分支、目标 SHA、JDK、Maven/Wrapper、POM 拓扑、发布范围、必需 CI。先检查 git status，保护用户未提交修改。多仓库或多工作树不得把路径、日志或 SHA 混线。
若项目已有正式规格或执行计划，从当前阶段继续；不要为同一变更重复创建事实源。
2. 建立证据矩阵
状态只允许：passed、failed、in_progress、blocked、skipped、unknown。skipped 必须附授权与风险，永不等于 passed。
| 分支 | SHA | 工具链 | 依赖来源 | 许可证策略 | SBOM | 完整 Reactor | local/tracking/remote | 必需 CI | 总结 |
|---|---|---|---|---|---|---|---|---|---|
<line> |
<sha> |
<state> |
<state> |
<state> |
<state> |
<state> |
<state> |
<state> |
<state> |
每格附可复核证据：实际命令、退出码、报告/日志路径、依赖坐标与版本、URL 及响应语义、run/job URL 或 ID、观察时间。HTTP 200 只证明可访问，不单独证明许可证语义正确。
3. 处理许可证与 SBOM
- 从依赖树或解析后的模型定位精确
groupId:artifactId:version与引入路径。 - 先检查代码是否直接依赖相关 API，再选择精确排除、上游修复或经治理批准的许可证选择。
- 许可证来源必须可追溯到该精确版本；优先固定版本、不可变的 POM/源码标签或官方仓库内容。
- 变更后重新生成许可证报告与 SBOM，并证明旧坐标/陈旧选择已消失、预期依赖仍存在。
- 跨分支共享脚本时比较内容、调用方式和文件模式；共享实现一致不代表各分支验证可以复用。
不要为让门禁变绿而选择没有可靠依据的许可证。若排除传递依赖，必须补充依赖树、契约/集成测试和新 SBOM 证明其不再进入交付物。
4. 闭合完整 Reactor
每条线使用其真实工具链执行项目定义的完整 Reactor。记录命令、工具版本、起止时间、模块/测试计数和最终退出码。
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 166 lines · 43 tokens per session scan A f94f0fa98a75
maven-multi-branch-license-gate-hardening is a skill published in the GitHub repository full-stack-skills/java-skills (5 stars, last pushed yesterday), licensed Apache-2.0. It adds 43 tokens to every session and 2,524 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-12.
Other skills, from other repositories
add-session-recording
Add privacy-aware session recording and replay to React applications using the Temps SDK. Captures user interactions for playback while respecting privacy through input masking, element blocking, and GDPR-compliant consent flows. Use when the user wants to: (1) Add session recording to their app, (2) Implement session…
ai-agents-external-claims
Verify external, vendor, and third-party claims (numbers, attributions, structure) against authoritative primary sources before they land in a repo artifact or external deliverable. Covers stake-holding sources, round-number tells, citation-chain drift, and the walk-the-gate-or-file-conservative discipline. Use when…
agentic-security-scanner
Scan and validate AI agent skills against the OWASP Agentic Skills Top 10 (AST10) security framework. Detects malicious skills, prompt injection, data exfiltration, supply chain risks, and cross-platform metadata loss. Provides CI/CD-ready security gating with SARIF output.
governance-enforcement
Generate, validate, and enforce content-bound governance plans and exact-head release attestations for governed work. Use when governance tooling or CI enforcement is being run or debugged; do not activate for policy-only decisions, ordinary project tests, or routine validation.
specification-writing
A workflow for writing complete patent specifications from patent claims and an invention disclosure. It adapts the document to a chosen jurisdiction, such as the US, Europe, or China.
regulatory-research-fallback
Fallback workflow for regulatory research when web extraction tools fail on government PDFs.