The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses bun and npm CLI tools to discover outdated packages, perform tarball diffs, and apply version updates. It also leverages the GitHub CLI (gh) to fetch release notes and changelog information.
[EXTERNAL_DOWNLOADS]: Fetches package metadata, source code diffs, and repository information from the official npm registry and GitHub. These are well-known services required for the skill's dependency auditing functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from external registries and source repositories using sub-agents for analysis, creating an attack surface for malicious package metadata.
Ingestion points: External data flows into the agent context via output from bun outdated, npm view, npm diff, and gh release view (SKILL.md).
Boundary markers: None identified in the skill instructions to delimit external content, although sub-agents are provided with a structured JSON schema for reporting their findings.
Capability inventory: The skill can modify project dependencies through bun update and write audit logs to the ~/.supply-chain/notes/ directory (SKILL.md).
Sanitization: No explicit sanitization or filtering of external package data is described before it is processed by the analysis sub-agents.

update-deps