The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads its core management script from skills.internetcomputer.org, which is the official domain of the vendor, DFINITY.
Evidence: curl -fsSL https://skills.internetcomputer.org/.well-known/skills/autoupgrade-icp-cli/scripts/upgrade-icp-cli.sh -o .claude/upgrade-icp-cli.sh
[COMMAND_EXECUTION]: The script executes standard package management commands (npm install -g, brew upgrade) to update the toolchain. It also executes a locally downloaded shell script.
Evidence: The script identifies the installation channel (npm, brew, or shell) and invokes the corresponding update command.
[PERSISTENCE]: The skill registers a SessionStart hook in .claude/settings.json to ensure the update check runs whenever a new session begins.
Evidence: Configuration block in SKILL.md Step 4 adds a command to the SessionStart hooks array.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the GitHub and Homebrew APIs (version strings) to determine if an update is needed.
Ingestion points: Fetches latest version tags from https://github.com/dfinity/icp-cli/releases/latest and https://formulae.brew.sh/api/formula/icp-cli.json.
Boundary markers: The script uses a dedicated note() function to sanitize output before it is returned to the agent context as JSON.
Capability inventory: The script can execute package managers and write to a throttle stamp file (.claude/.icp-upgrade-check).
Sanitization: The note() function removes backslashes, double quotes, and newlines to prevent JSON injection or terminal escape sequences.

autoupgrade-icp-cli