The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various system commands including git, dart, flutter, fvm, melos, and the GitHub CLI (gh). These operations are essential for its primary functions: managing branches, upgrading package versions, applying automated fixes, performing static analysis, and creating pull requests.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and summarizes CHANGELOG content from external sources (pub.dev). This presents an indirect prompt injection surface where a malicious package author could attempt to influence the AI's pull request summary by including instructions in their package's changelog.
Ingestion points: CHANGELOG data is fetched from pub.dev via the fetchChangelog function in scripts/bin/dart_pub_upgrade.dart.
Boundary markers: No specific delimiters or instructions are provided to the LLM to ignore embedded commands within the changelog text during the summarization phase.
Capability inventory: The skill has significant capabilities including file system access (read/write), network access (fetching from pub.dev), and shell command execution (git, gh).
Sanitization: The script performs string-based diffing to isolate version changes but does not sanitize the text for potential injection patterns before passing it to the LLM for summarization.
[EXTERNAL_DOWNLOADS]: The skill interacts with the official Dart package registry (pub.dev) to fetch package metadata and download archives for changelog extraction. These activities target well-known, trusted infrastructure within the Dart development ecosystem.

dart-pub-upgrade