The Agent Skills Directory

[SAFE]: The skill follows established best practices for Node.js project maintenance, focusing on diagnostic and upgrade commands for npm, yarn, and pnpm. No malicious intent or obfuscation was found.
[COMMAND_EXECUTION]: The skill utilizes a custom Python utility, scripts/diff_lock.py, to help resolve merge conflicts. This script safely executes git commands using argument lists to avoid shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes external project data such as package-lock.json files and npm audit reports. This represents a potential surface for indirect injection if a project contains maliciously named dependencies, but the risk is managed by the skill's intended use within the developer's controlled repository environment.
Ingestion points: The scripts/diff_lock.py script reads package names and versions from package-lock.json and git objects.
Boundary markers: Data is parsed as structured JSON, though output command strings are generated using simple string concatenation.
Capability inventory: The skill instructs the agent to execute shell commands (npm, git, python3) and manage file system contents within a Node.js project.
Sanitization: Standard json.loads is used for parsing lock files; however, the script does not apply specific shell-escaping to the package names it outputs for subsequent npm install commands.

npm-upgrade