The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions provide examples for executing local Node.js scripts using the mise task runner to manage migration recipes (e.g., mise exec -- node scripts/list-codemods.mjs).- [DYNAMIC_EXECUTION]: The runner script scripts/run-codemod.mjs uses dynamic import() to load transformation logic from transform.mjs files within the migration recipes. This is an intended design pattern for the skill's extensible architecture and is limited to local files.- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the agent reading and applying instructions from markdown files to modify a project's source code, which constitutes a potential vulnerability surface. The skill mitigates this through:
Ingestion points: Loading project files via ts-morph and reading instructions.md from codemod directories.
Boundary markers: Instructions explicitly advise verifying changes and inspecting diffs in dry-run mode before final application.
Capability inventory: The skill modifies AST structures and saves changes to the file system.
Sanitization: The assertWritableTarget function prevents the tool from modifying files in protected or output-only directories such as .git, dist, and node_modules.

codemod