The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by instructing the agent to ingest and act upon data from external, untrusted sources.
Ingestion points: The instructions in SKILL.md require the agent to "Verify dependency versions and release status live" and "read migration notes" for frameworks like Next.js, Expo, Convex, and Clerk.
Boundary markers: The skill lacks explicit instructions or markers to distinguish between legitimate technical guidance and potentially malicious instructions embedded in external documentation or package metadata.
Capability inventory: The agent possesses capabilities to execute shell commands (bun run check, bun install), modify the project structure, and update configuration files based on the fetched external data.
Sanitization: No mechanisms for filtering or sanitizing the content of external migration guides or registry metadata are specified before the agent processes this information.

react-stack