The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external project files such as package.json, tsconfig.json, and .env to perform migration analysis. These files represent an attack surface where maliciously crafted project data could attempt to influence the agent's instructions.
Ingestion points: Project configuration files are read using the Read and Grep tools in SKILL.md (e.g., cat package.json, cat tsconfig.json).
Boundary markers: The skill lacks explicit delimiters or instructions to the agent to disregard natural language instructions that might be embedded within these configuration files.
Capability inventory: The skill utilizes Bash (shell execution), Read (file access), and Write (file modification) tools.
Sanitization: No explicit sanitization or schema validation is performed on the ingested JSON/text data before it is processed by the agent.
[COMMAND_EXECUTION]: The skill executes standard development and migration commands using the Bash tool, including bun install, git commit, and project analysis commands (node --version, ls -la). These operations are consistent with the skill's primary purpose of runtime migration.
[EXTERNAL_DOWNLOADS]: The skill uses bun install and bun add to download and manage dependencies from the NPM registry. It also references official documentation and repositories from the oven-sh organization (the creators of Bun), which are recognized as well-known and expected sources for this use case.

node-to-bun