The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx @ouds/web-migrate, which involves downloading the migration utility from the NPM registry. This is a standard and expected behavior for accessing the vendor's design system tools.
[REMOTE_CODE_EXECUTION]: Executing code via npx from the NPM registry constitutes remote code execution. The package @ouds/web-migrate is a scoped package belonging to the project's design system ecosystem.
[COMMAND_EXECUTION]: The skill provides explicit shell commands for running the migration tool with various flags (e.g., --from=boosted, --from=ob1) and file glob patterns.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill reads package.json and package-lock.json from the user's project to determine the current design system dependencies.
Boundary markers: No specific delimiters are used, but the logic maps the detected dependencies to a predefined and restricted set of CLI flags, which mitigates the risk of malicious data influencing the command execution.
Capability inventory: The skill executes shell commands via npx and modifies local files according to the provided glob patterns (Step 3).
Sanitization: The instructions include explicit warnings against unsafe file globs (like "**/*.*") to prevent the tool from processing or corrupting binary and unrelated files.

migrate-to-ouds-web