The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches package metadata and artifacts from the official NPM registry and retrieves commit enrichment data from the GitHub API. These downloads originate from well-known, trusted services and are consistent with the skill's primary purpose of version auditing.- [INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted code and manifests from external sources. Ingestion points: Processes Git trees and NPM package contents via scripts/gen-artifacts.mjs and scripts/materialize-npm.mjs. Boundary markers: The skill employs parallel recon agents with specific target scopes but does not explicitly wrap audited content in prompt delimiters. Capability inventory: Uses git, npm, and node to perform analysis. Sanitization: Utilizes the --ignore-scripts flag during package installation to prevent the execution of potentially malicious lifecycle hooks in the audited packages.- [COMMAND_EXECUTION]: Executes git and npm commands through controlled child processes to extract project information. The implementation includes logic to prevent shell injection, particularly in Windows environments where shell execution is required.

dsh-upgrade-audit