The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted data including release notes, changelogs, and migration guides to inform its update decisions and code adaptations. This presents a surface for indirect prompt injection attacks where malicious instructions hidden in a changelog could influence the agent's behavior during the 'apply' phase.
Ingestion points: External release notes and changelogs fetched via network, as well as repository files parsed for usage patterns (specified in SKILL.md).
Boundary markers: The instructions do not define clear delimiters or 'ignore' commands for the ingested external content.
Capability inventory: The skill uses vp update, executes arbitrary repository check scripts (e.g., build.sh or runtime_tool.py), and modifies repository manifests and source files.
Sanitization: There are no instructions for sanitizing or escaping the content retrieved from external sources before it is processed by the agent.
[COMMAND_EXECUTION]: The skill is designed to execute various commands within the repository context. This includes platform-specific update tools (vpx taze, vp update) and arbitrary verification commands defined by the repository (e.g., python3 runtime_tool.py check, docforge render, ./build.sh as seen in evals/files/). While necessary for the skill's purpose, this allows for the execution of code contained within the target repository.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to retrieve version indexes (e.g., https://nodejs.org/dist/index.json) and external documentation/release notes from various third-party domains. While the skill encourages using 'official' sources, it lacks a strictly enforced whitelist for these downloads, potentially exposing the agent to malicious domains.

repository-updater