The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs shell command execution to manage dependencies and verify the repository state.
Evidence: Uses npm view to check latest versions, npm pack and npm install to handle package contents, and Get-Command pi or mise which pi to locate existing installations.
Evidence: Automatically runs the project's own test suite as part of the verification process in Step 5.
[EXTERNAL_DOWNLOADS]: The skill downloads external code and metadata from the NPM registry, a well-known service.
Evidence: Fetches package metadata and tarballs for scoped packages (e.g., @earendil-works/...) to perform drift analysis and triage.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and act upon content from external, untrusted sources such as changelogs and documentation, which could theoretically contain malicious instructions.
Ingestion points: CHANGELOG.md, official API documentation, and exports maps from target packages (Step 1, Step 3, Step 6).
Boundary markers: No explicit delimiters or instructions are used to distinguish between data and commands within the ingested documentation.
Capability inventory: The skill has the ability to modify source code (Step 4, Step 6), install packages (Step 1), and execute shell commands/tests (Step 5).
Sanitization: There is no evidence of sanitization or filtering for instructions embedded within the changelog or documentation text.

my-pi-extension-maintenance