The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources during the audit process, creating a vulnerability surface.
Ingestion points: Fetches data from WebSearch (CVEs, security advisories) and parses external package release notes and runtime requirements.
Boundary markers: None identified; instructions do not explicitly tell the agent to ignore or delimit embedded instructions in the fetched data.
Capability inventory: The skill has the ability to write to multiple project files (upstreams.yaml, install.sh, launcher/build.py, .mcp.json), execute package installations via npm and uv, and run local test suites (pytest).
Sanitization: No sanitization or validation of the external content is mentioned before it is processed or used to influence the audit report.
[REMOTE_CODE_EXECUTION]: The skill performs installation tests that involve executing code from remote sources.
Evidence: npm install is executed for packages with scripts_policy: allow, which runs lifecycle scripts provided by the remote package.
Automated Scan Analysis: An automated scan flagged a pipe to python3 from a curl command fetching PyPI metadata. Analysis confirms the command uses python3 -c to execute a static, safe JSON parsing script to extract version information from PyPI, a well-known service.
[EXTERNAL_DOWNLOADS]: The skill fetches content from several well-known services and package registries.
Evidence: Downloads metadata and scripts from pypi.org, npmjs.com, and github.com (e.g., nvm-sh/nvm). These sources are recognized as well-known technology services and the behavior is documented neutrally as part of the skill's primary audit function.
[COMMAND_EXECUTION]: The skill uses local shell commands to interact with the system and verify updates.
Evidence: Executes git ls-remote, brew info, npm view, and shasum to audit versions and integrity.

upstream-audit