The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the ! command syntax in SKILL.md to execute shell commands when the skill is loaded by the agent.
A Node.js one-liner script reads and parses the project's package.json to extract basic metadata (name, version) and Capacitor-related dependencies.
A find command is used to locate relevant project subdirectories (example-app, ios, android).
These operations are used to provide the agent with immediate project context and do not perform network operations or access sensitive system files.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection via the ingestion of project metadata.
Ingestion points: Content from the local project's package.json file is read into the agent's context during skill initialization via dynamic context execution in SKILL.md.
Boundary markers: The data is injected directly into the skill snapshot without explicit delimiters or instructions to ignore embedded content.
Capability inventory: The skill is configured with allowed-tools for Bash(node -e *) and Bash(find *) as defined in the YAML frontmatter of SKILL.md.
Sanitization: The injected script performs JSON parsing and key-based filtering, which provides validation for the structure and content of the input data.
[COMMAND_EXECUTION]: The skill is configured to use command-line tools for project analysis and modification.
The allowed-tools section explicitly permits the use of node -e and find within the Bash environment.
These tools are used for legitimate project discovery and management tasks associated with the intended upgrade process.

capacitor-plugin-upgrade-v4-to-v5