The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project configuration data which is then processed by agents with shell and file-system capabilities.
Ingestion points: The agent reads package.json, biome.jsonc, biome.json, .eslintrc*, and .prettierrc* within the user's project directory as documented in agents/config-validator.md and agents/migration-assistant.md.
Boundary markers: Agent prompts do not utilize explicit delimiters or specific instructions to ignore embedded commands within the read configuration content.
Capability inventory: The skill possesses and utilizes Bash, Write, Edit, and Read tools for diagnostics and migration tasks.
Sanitization: Ingested file content is not explicitly sanitized or escaped before being processed or used in shell command construction.
[COMMAND_EXECUTION]: The skill scripts and commands execute shell operations necessary for project setup and migration.
Evidence: scripts/install-ultracite.sh, scripts/migrate-to-ultracite.sh, commands/doctor.md, and commands/migrate.md use the Bash tool to run operations like bun x ultracite init, find, node --version, and npx ultracite check. These are aligned with the skill's primary function of managing development environments.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of development dependencies from well-known package registries.
Evidence: Initialization and migration workflows install packages such as ultracite, eslint, prettier, and @biomejs/biome using standard package managers (npm, bun, pnpm, yarn). These target established registries and the vendor's own official packages.

ultracite