The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its ingestion of external data during Phase 2, where it researches migration notes, breaking changes, and migration guides via web searches or documentation lookups. This content directly influences the agent's upgrade plan and subsequent code edits.
Ingestion points: External changelogs, migration guides, and native audit tool outputs (SKILL.md, references/stack-adapters.md).
Boundary markers: The skill structures its output into specific files (plan.md, deps.md), but does not define explicit prompt delimiters or 'ignore' instructions for the external documentation content it reads.
Capability inventory: The agent has the authority to execute native package managers (npm, pip, cargo, etc.) and write to manifests and lockfiles (SKILL.md).
Sanitization: No explicit sanitization, filtering, or validation of the external changelog content is described before it is processed by the agent.
[COMMAND_EXECUTION]: The skill invokes native ecosystem tools such as npm audit, pip-audit, cargo audit, and their respective package installation commands. Furthermore, the 'unblock protocol' in references/preflight.md permits the agent to install missing tooling or dependencies if environmental blockers prevent preflight resolution.
[EXTERNAL_DOWNLOADS]: The skill fetches documentation and changelogs from external web sources during its research phase (Phase 2). It also communicates with official package registries when running audit tools and performing upgrades.
[REMOTE_CODE_EXECUTION]: The process of upgrading dependencies can trigger the execution of arbitrary install scripts defined by the updated packages. The skill identifies this risk and includes a specific mandate in its 'full' mode to flag dependencies that introduce new install-time execution or git-sourced transitive trust before they are applied.

nuke-deps