The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local CLI commands to audit the project environment, including ddev composer why-not, ddev composer audit, and typo3-console commands. These are standard tools for PHP/TYPO3 development and are used here for inventory and security auditing purposes. It also references a local script scripts/pull-live-dataset.mjs for data synchronization, which is documented as a read-only operation on the source server.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion point for untrusted data by reading the local database, fileadmin contents, and configuration files (composer.json, settings.php). While it lacks explicit boundary markers for this data, the risk is mitigated by the skill's primary focus on recording metrics and evidence rather than using the ingested data to drive autonomous execution logic. The skill also enforces human-in-the-loop approvals for data recovery and acceptance decisions.
[CREDENTIALS_SAFE]: The skill includes instructions to identify and reject hardcoded secrets or committed credentials in the project environment, which is a positive security practice. It specifically mandates recording credential origins without reading or printing the actual values.

typo3-upgrade-intake