The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the execution of shell commands to manage dependencies, including environment cleanup (e.g., rm -rf node_modules), package installation (npm install, pip install, go get), and diagnostic checks. It includes scripts like scripts/run-taze.sh that pass arguments directly to underlying tools.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process local project configuration files which are externally controlled and could be manipulated to inject malicious instructions.\n
Ingestion points: The workflow involves scanning and reading files such as package.json, go.mod, Cargo.toml, requirements.txt, and others to identify project types and dependency lists (Workflow Step 1 and Step 3).\n
Boundary markers: There are no explicit instructions to the agent to treat data from these files as untrusted or to ignore any natural language instructions that might be embedded within them.\n
Capability inventory: The skill has access to shell execution and package management tools, including npm, pip, go, cargo, and rm -rf, providing a high-impact target for successful injection.\n
Sanitization: The instructions do not specify any validation or sanitization steps for the data retrieved from project files before it is processed by the AI agent.

dependency-updater