The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing a provided Dart script (scripts/bin/dart_pub_upgrade.dart) which spawns several shell processes including git status/checkout/add/commit, dart pub/fix/analyze, flutter pub, fvm, and melos. It also instructs the agent to use the GitHub CLI (gh) to create pull requests.
[EXTERNAL_DOWNLOADS]: The included Dart script performs network requests to the official package registry (pub.dev) to fetch metadata and download source archives (tarballs). It extracts CHANGELOG.md files from these archives in-memory to generate diffs.
[PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection (Category 8) because it fetches untrusted content from the web and asks the AI to process it.
Ingestion points: Untrusted text from CHANGELOG.md files on pub.dev is saved to changelog_diffs.json and subsequently read by the AI for summarization.
Boundary markers: Absent. There are no explicit instructions or delimiters used to warn the AI about potential instructions embedded within the changelog content.
Capability inventory: The agent has significant capabilities including filesystem access, shell command execution (via the skill script), and the ability to create Pull Requests using the gh CLI.
Sanitization: No sanitization or filtering is performed on the changelog text before it is presented to the AI.

dart-pub-upgrade