The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill employs the !command`` pattern in SKILL.md to execute npm list and pip show. These commands are used solely to assess the current environment's package versions upon loading and are considered benign.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing well-known packages from official registries (e.g., @langfuse/client, @opentelemetry/sdk-node). These dependencies are standard for the tool's functionality.
[DYNAMIC_EXECUTION]: A node -e script is included in the migration steps to verify successful trace exports. Additionally, a ts-morph codemod template is provided in the reference documentation for automated code updates. These are routine development practices for SDK migrations.
[INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for untrusted data as it reads and edits project source code.
Ingestion points: Project source files read via the Read and Edit tools.
Boundary markers: None present.
Capability inventory: File writing, editing, and constrained shell execution via npm and pip.
Sanitization: None present. This surface is necessary for the skill's primary purpose of code migration and is evaluated as safe in this context.

langfuse-upgrade-migration