The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches alert data from the official GitHub API (api.github.com) using the GitHub CLI. These interactions target a well-known, trusted service and are essential for identifying required security patches.
[COMMAND_EXECUTION]: The skill uses shell commands to check authentication status (gh auth status), query the GitHub API (gh api), and execute project-specific build and test scripts (mise exec --). These commands are standard for developer-centric tasks and are executed within the repository context.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external Dependabot advisories. It manages this attack surface by using structured JSON parsing via jq and requiring local verification of all dependency changes.
Ingestion points: The output of gh api calls described in SKILL.md serves as the primary external data source.
Boundary markers: While the skill uses jq to isolate specific data fields, it does not implement explicit natural language delimiters for the injected content.
Capability inventory: The skill has the capability to perform network requests (to GitHub), modify local manifest files (e.g., package.json), and execute commands via the mise task runner.
Sanitization: Data is parsed and filtered using jq to ensure only specific fields (like version numbers and package names) are processed by the agent.

github-dependabot