The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as changelogs and release notes from third-party repositories, which could contain malicious instructions designed to influence the agent.
Ingestion points: The skill (Step 3) and its sub-agents (Collector brief) fetch text from external URLs, including GitHub releases, CHANGELOG.md files, and security advisories.
Boundary markers: While the skill uses structured JSON for internal data passing between agents, it lacks explicit instructions to treat the fetched release note content as untrusted or to ignore embedded instructions within that content.
Capability inventory: The skill can execute shell commands for version auditing (versions.sh, npm audit, composer audit) and has the capability to write plan files to the local filesystem.
Sanitization: No specific sanitization or filtering of the external text content is performed before the agent analyzes it.
[COMMAND_EXECUTION]: The skill executes local scripts and standard package management tools to analyze the project environment.
Evidence: SKILL.md invokes bash <skill-dir>/scripts/versions.sh to resolve package information. It also uses composer audit and npm audit to check for known vulnerabilities in installed packages.
[EXTERNAL_DOWNLOADS]: The skill fetches package metadata and release info from official registries and well-known services.
Evidence: versions.sh uses curl to retrieve data from repo.packagist.org and registry.npmjs.org. The sub-agents fetch release information from github.com and related domains. These are well-known services in the software development ecosystem.

upgrade-plan