The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process package.json and lockfiles, which are external and potentially untrusted inputs. This creates a surface where malicious content in these files could attempt to influence agent behavior.
Ingestion points: Monitors package.json, pnpm-lock.yaml, and package-lock.json via the paths frontmatter.
Capability inventory: The agent is instructed to perform powerful actions such as pnpm install, pnpm run build, and pnpm test based on the content of these files.
Boundary markers: The skill does not provide specific delimiters or instructions to the agent to ignore or sanitize embedded strings within the parsed JSON data.
Sanitization: No explicit validation or sanitization of input data is specified before it is used in command arguments or build scripts.
[COMMAND_EXECUTION]: The skill guides the agent to execute various shell commands to manage the project environment.
Evidence: Explicit instructions to run pnpm install, pnpm audit --fix --force, pnpm run build, and pnpm test to verify maintenance changes.
[EXTERNAL_DOWNLOADS]: The skill references and fetches configuration templates from external sources to use as a ground truth for maintenance.
Evidence: References several raw GitHub URLs belonging to the author's organization (lenneTech), including nuxt-base-starter, nest-server-starter, and nest-server package files. These are documented as vendor-owned resources used for reference purposes.

maintaining-npm-packages