The Agent Skills Directory

[COMMAND_EXECUTION]: The skill discovers and executes verification commands found in the repository (e.g., npm test, make check, or commands extracted from CI workflows). These are used as a 'verify gate' to ensure that automated version updates do not break the project. This is a core feature for the audit's functionality.
[EXTERNAL_DOWNLOADS]: The skill performs web searches and fetches data from authoritative sources such as endoflife.date to retrieve toolchain release metadata and end-of-life dates. This information is used only for comparison and reporting purposes.
[PROMPT_INJECTION]: The skill ingests data from untrusted manifest files within a repository, creating a potential surface for indirect prompt injection.
Ingestion points: Toolchain pins read from files like .nvmrc, package.json, Dockerfile, and .github/workflows/*.yml.
Boundary markers: Absent; the skill extracts version strings verbatim for recording in the audit report.
Capability inventory: The skill can write to the filesystem (to bump versions) and execute shell commands (to run tests) via the agent's core tools.
Sanitization: The skill mitigates risks by delegating all logic to external Python scripts. Specifically, lib/version_gap.py uses a restrictive regular expression (^[^\d]*?(\d+)) to extract only numeric version components, ensuring that non-numeric or malicious text in a version pin cannot influence the audit's decision-making logic.

staleness-audit