The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The detect-versions.mjs script performs network requests to https://registry.npmjs.org/ to fetch the latest version information for packages. This is a well-known service and is standard behavior for package management tools.
[COMMAND_EXECUTION]: The skill executes local commands such as node skills/gramio-upgrade/detect-versions.mjs and project-specific package manager commands (e.g., npm install, bun install, pnpm install, yarn) to perform the upgrade. These are necessary for the skill's primary function and are performed within the user's project directory.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from project files to determine the upgrade path.
Ingestion points: The agent reads the user's package.json and the contents of node_modules (specifically package.json files within dependency folders) to detect installed versions (SKILL.md, Step 1).
Boundary markers: No explicit delimiters or boundary instructions are provided for the project file reads; however, the agent is instructed to use the bundled MIGRATIONS.md as the authoritative "source of truth" for the migration logic.
Capability inventory: The skill has access to Bash, Read, Edit, Write, Grep, and Glob. It can execute shell commands, read/write files, and search the project directory.
Sanitization: The skill does not mention specific sanitization for ingested package.json data, but the detect-versions.mjs script uses standard JSON.parse and strictly extracts the version field.

gramio-upgrade