The Agent Skills Directory

[COMMAND_EXECUTION]: The skill guides the agent to use standard package management CLI tools including npm audit, npm outdated, npm install, and npm explain. It also instructs the agent to run production builds to validate dependency changes, which are expected operations for a maintenance skill.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external project files including package.json, lockfiles, .npmrc, and dated dependency records in .agents/dependencies/. While these ingestion points represent a potential attack surface, the instructions mitigate this by requiring the agent to review official release notes, advisories, and newly added install scripts before granting permissions or proceeding with updates.
Ingestion points: package.json, .npmrc, package manager lockfiles, and .agents/dependencies/*.md files.
Boundary markers: None specified within the skill instructions.
Capability inventory: Shell command execution via package managers and build tools, and local file writing for recording maintenance decisions.
Sanitization: Relies on manual inspection of release notes, dependency paths, and install scripts to identify suspicious changes.
[SAFE]: The skill demonstrates safe practices by discouraging the use of forceful overrides like npm audit fix --force and prioritizing targeted, stable updates over indiscriminate upgrades.

dependency-maintenance