The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes project-specific files such as package.json, requirements.txt, go.mod, and Cargo.toml. These files could potentially contain malicious content designed to influence the agent's behavior during the analysis or update process. While the skill identifies these as ingestion points, it mitigates risk by implementing a workflow that requires user confirmation for major version updates and uses semantic versioning awareness to categorize changes.
[COMMAND_EXECUTION]: The skill executes various CLI tools and local shell scripts (scripts/check-tool.sh, scripts/run-taze.sh) to manage dependencies. These commands include standard package manager operations (e.g., npm audit, pip install --upgrade, go get -u, cargo update) and are limited to the scope of dependency management and security auditing.
[EXTERNAL_DOWNLOADS]: The documentation and scripts recommend the installation of third-party utility tools like taze, pip-review, govulncheck, and cargo-audit through official package registries (npm, PyPI, etc.). These are well-known tools within their respective developer communities and are used here for their intended purpose of project maintenance.

dependency-updater