The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes local Node.js scripts (scripts/vendor-sync.mjs and scripts/*.test.mjs) to perform synchronization logic and verification tests.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub issues and remote repositories, creating a potential vulnerability surface.
Ingestion points: External content is ingested via gh issue view (GitHub issue descriptions) and git clone/git show (upstream repository files).
Boundary markers: The instructions explicitly direct the agent to treat external issue content as a suggested plan rather than ground truth and to use the results of a local dry-run for verification.
Capability inventory: The agent has the capability to execute shell commands, modify or delete files (git merge-file, git rm), and perform network operations such as git push and closing GitHub issues.
Sanitization: The skill employs mechanical verification steps, including the use of cmp and awk to extract and compare diff signatures, ensuring that local patches remain intact during three-way merges.

vendor-sync