The Agent Skills Directory

[SAFE]: The skill utilizes standard command-line tools like grep, git, node, and npm for routine project maintenance and version checking within the local environment.\n- [COMMAND_EXECUTION]: Automated migrations are performed using vendor-specific CLI tools (os, skills). These operations are scoped to local project metadata and do not involve unauthorized file access or network exfiltration.\n- [DYNAMIC_EXECUTION]: Short Node.js snippets are used to programmatically read and display information from local JSON configuration files. These scripts are hardcoded and do not process external or untrusted input strings.\n- [EXTERNAL_DOWNLOADS]: The skill manages tool updates by installing vendor-owned packages (@objectstack/skills) from the standard registry. This is consistent with legitimate maintenance of development tooling.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes project configuration files which serves as an ingestion point for external data.\n
Ingestion points: Reads package.json, objectstack.config.ts, and spec-changes.json (SKILL.md).\n
Boundary markers: Uses markdown instructions to guide the agent through the migration workflow.\n
Capability inventory: Includes file system writes via os migrate, package installation via npm, and local script execution via node -e.\n
Sanitization: No explicit sanitization is performed on configuration values before they are used to drive the migration logic.

objectstack-upgrade