The Agent Skills Directory

[SAFE]: The skill utilizes native package managers and follows a conservative, batch-based upgrade strategy that prioritizes project stability and lockfile integrity.
[SAFE]: Comprehensive security measures are integrated into the workflow, including mandatory vulnerability audits, provenance verification for new packages, and the inspection of install scripts before execution.
[SAFE]: The skill contains explicit safeguards against high-risk operations, specifically prohibiting credential rotation, unauthorized package publishing, and the weakening of security or verification gates.
[SAFE]: A robust rollback mechanism is required for any failed upgrade batch, ensuring the workspace remains in a known good state and protecting existing user work.
[SAFE]: The skill has a potential indirect prompt injection surface due to the ingestion of external data, but this is assessed as safe given the task context and verification requirements.
Ingestion points: SKILL.md (Section 2) involves researching official release notes, migration guides, and security advisories from external sources.
Boundary markers: The skill does not define explicit delimiters for this external data, but it treats the information as research evidence rather than direct instructions.
Capability inventory: Operations are limited to native package managers (npm, pip, etc.), git, and existing repository-defined build/test scripts.
Sanitization: The skill mitigates risks by requiring that all research-driven changes be verified through local build, test, and audit suites before being accepted.

ln-32-dependency-upgrader