The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and process external files like CHANGELOG.md and MIGRATION.md, which creates an attack surface for instructions embedded in those documents to influence the agent's behavior.
Ingestion points: Instructions specifically guide the agent to read local changelogs and migration guides.
Boundary markers: The skill does not provide explicit boundary markers or instructions to ignore potential commands within the ingested text.
Capability inventory: The skill has extensive capabilities, including file modification via Node.js scripts and shell command execution (npm, npx, git).
Sanitization: No sanitization or validation of the ingested content is described before the agent processes it.
[DYNAMIC_EXECUTION]: The skill provides templates for generating and executing local scripts to automate code migrations.
Script generation: Includes a custom migration script using glob and fs to perform bulk find-and-replace operations on source code files.
[COMMAND_EXECUTION]: The skill relies on shell commands for auditing, analyzing, and upgrading dependencies.
Package management: Uses npm and yarn for installation and auditing tasks.
Remote data: Fetches official documentation from Facebook's GitHub repository using curl.
Tool execution: Runs various development utilities via npx (e.g., madge, npm-check-updates, react-codeshift).

dependency-upgrade