The Agent Skills Directory

[SAFE]: The skill instructions in SKILL.md establish strong security boundaries, including prohibitions against eval, piped shell executions (curl | bash), and silent dependency installations.
[SAFE]: The included scripts/audit-js-files.sh script is designed for read-only analysis and includes robust input validation, such as path traversal checks and existence verification, to ensure it only operates within the intended project directory.
[SAFE]: Data protection is prioritized with explicit rules against printing credentials or secrets in logs or reports.
[SAFE]: The migration process is divided into THINK, PLAN, and EXECUTE phases, requiring user confirmation for plans and package installations, which mitigates the risk of unauthorized or unexpected changes.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because its primary function is to ingest and analyze local source code.
Ingestion points: scripts/audit-js-files.sh identifies and reads all JavaScript-related files (.js, .jsx, .mjs, .cjs) within the project.
Boundary markers: No explicit delimiters are currently defined to separate untrusted file content from instructions.
Capability inventory: The agent has the capability to modify project files, rewrite package.json, and perform npm installations.
Sanitization: The audit script performs path validation to prevent access outside the project scope.

js-to-ts-incremental-migrator