The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches distribution archives from the official Drupal file server (ftp.drupal.org) to establish a pristine base for diffing. This is a well-known service used for package management.
[COMMAND_EXECUTION]: The skill instructs the agent to use a variety of command-line tools including grep, curl, unzip, patch, rsync, diff, sed, and composer. These are standard tools for the stated purpose of package maintenance and patch generation.
[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface where it ingests untrusted data from the project being analyzed.
Ingestion points: The agent reads package names, versions, and existing patch data from composer.json, composer.lock, and .info.yml files (specified in Step 1 and 2 of the Workflow).
Boundary markers: The instructions do not define explicit delimiters or "ignore embedded instructions" warnings for the content read from these files.
Capability inventory: The skill uses grep, curl, unzip, patch, diff, sed, and composer to process the extracted information.
Sanitization: There is no explicit sanitization or validation of the module names or version strings extracted from the metadata files before they are interpolated into shell commands (e.g., inside the curl or grep calls).

composer-patch-generator