The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches package metadata from the official PyPI registry and performs HEAD requests to GitHub to verify release tags. These operations target well-known, trusted services.
[COMMAND_EXECUTION]: The skill executes standard development tools, including git for version control, uv for package management and testing, and the GitHub CLI (gh) for pull request creation. These commands are necessary for the skill's primary function.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from PyPI metadata to generate PR descriptions and comparison links, creating a potential ingestion surface for untrusted content.
Ingestion points: The scripts/resolve_dependency.py script fetches JSON metadata from https://pypi.org/pypi/{package}/json.
Boundary markers: The workflow includes a mandatory review step (Step 16) where the agent must present the PR draft and wait for explicit user approval before proceeding.
Capability inventory: The skill has capabilities to modify the local filesystem, install packages via uv pip install, and create PRs via gh pr create.
Sanitization: The helper script implements strict regex validation (_NAME_MATCH, _VERSION_MATCH) for all extracted metadata fields and uses urllib.parse.quote to sanitize package names before inclusion in URLs.

bump-dependency