The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data and is explicitly instructed to follow instructions contained within that data.
Ingestion points: Step 3 fetches release notes using gh release view --json body and reads CHANGELOG.md files from external repositories.
Boundary markers: None. The skill does not use delimiters or warnings to treat the release note content as untrusted.
Capability inventory: The skill has access to the Bash tool for running package managers (npm, pnpm, yarn, bun), project scripts (build, test, etc.), and gh CLI. It can also modify local files (Step 5 and 6).
Sanitization: None. The skill is instructed in Step 6 to 'apply the migration' named in the release notes if a check fails, which could lead the agent to execute arbitrary commands suggested by a malicious package author.
[COMMAND_EXECUTION]: The skill executes various package manager commands and project-specific scripts.
It runs npm view, gh release view, and gh api to gather information.
It executes install and user-defined scripts (build, check, typecheck, test) using pnpm, npm, yarn, or bun based on the project configuration.
[DYNAMIC_EXECUTION]: The skill runs project scripts defined in the root package.json. While this is necessary for verifying dependency upgrades, it involves executing arbitrary code defined in the local environment which may have been modified by the dependency upgrade process.

upgrade-dependencies