The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on standard shell commands to audit and manage Node.js projects, including pnpm outdated, pnpm audit, pnpm update, and pnpm add. It also utilizes common utilities like jq for JSON parsing and grep for string searching within project files.
[EXTERNAL_DOWNLOADS]: Performs updates and fetches security audit data from the official npm registry through the project's package manager. These operations are essential to the skill's primary function and target well-known, trusted package registries.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting third-party data from the npm registry (package names, version strings, and CVE titles) which are then processed by the agent to generate triage reports.
Ingestion points: Captured outputs from pnpm audit --json and pnpm outdated --json (SKILL.md).
Boundary markers: The skill uses jq to structure data, but lacks explicit LLM boundary delimiters to isolate external strings from instructions.
Capability inventory: Possesses capabilities for further command execution including pnpm test, pnpm build, and package installation (SKILL.md).
Sanitization: Content is filtered via jq, but registry-supplied descriptions (e.g., vulnerability titles) are presented to the agent without specific sanitization.
[DYNAMIC_EXECUTION]: Instructs the agent to run project-specific scripts (pnpm test:ci, pnpm lint) and external codemods (e.g., @tailwindcss/upgrade). This involve executing code that is either part of the project's own codebase or downloaded from the npm registry for the purpose of automated migration.

dep-lib-review