The Agent Skills Directory

[COMMAND_EXECUTION]: The skill leverages the Bash tool to run several project-related commands, such as npm audit, pnpm audit, yarn audit, and npm outdated. These commands are central to the skill's purpose of identifying security vulnerabilities and maintenance needs in software dependencies.
[EXTERNAL_DOWNLOADS]: In commands/audit-deps.md, the skill uses npx license-checker to perform license compliance audits. The npx command may fetch the license-checker package from the public npm registry at runtime if it is not already available in the local environment.
[INDIRECT_PROMPT_INJECTION]: The skill functions by parsing and acting upon data retrieved from external command outputs, which serves as an attack surface for indirect prompt injection.
Ingestion points: The skill ingests JSON data from the output of npm audit, pnpm audit, and license-checker via commands/audit-deps.md and agents/dep-auditor.md.
Boundary markers: There are no specific boundary markers or "ignore instructions" warnings implemented to isolate the tool output from the agent's internal reasoning.
Capability inventory: The agent possesses the capability to execute shell commands via Bash and read files, including the ability to run npm update or npm audit fix which modifies project dependencies.
Sanitization: The instructions do not define any sanitization, filtering, or validation steps for the external JSON data before it is processed by the agent.

dependency-audit