The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill maintains a surface area for indirect prompt injection by ingesting untrusted data from repository-specific configuration files and external release notes.
Ingestion points: Untrusted data enters the agent context via AGENTS.md (or equivalent repository instructions), package manifests, and external URLs for changelogs and release notes researched during the sweep.
Boundary markers: The instructions establish an explicit boundary for existing user changes and mandate read-only commands for Audit mode, though they do not specify technical delimiters or "ignore" warnings for the content of the external documentation itself.
Capability inventory: The skill possesses capabilities for file system modification, command execution through package managers, and Git operations (commit, push, and pull request creation).
Sanitization: The skill does not describe specific sanitization or filtering protocols for the text content of fetched changelogs or release notes before processing.
[COMMAND_EXECUTION]: The skill executes package manager binaries (npm, pnpm, yarn) to resolve dependencies and run validation gates (tests, builds, linters). This inherently includes the execution of arbitrary code defined in package lifecycle scripts (e.g., postinstall) within the dependency tree.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch package data from registries and documentation from primary sources such as pnpm.io. These are standard operations for the skill's intended purpose of dependency maintenance.

update-dependencies