The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions to use npm view and pnpm add for managing package versions. These are standard operations using well-known package management tools.
[DYNAMIC_EXECUTION]: The skill facilitates the use of a loadIntegrations utility which dynamically executes JavaScript code fetched from a remote JSON source (javascript_integration.json). The documentation explicitly identifies this as arbitrary script execution and provides detailed guidance on mitigation strategies, including CSP gates and allow-list validation.
[INDIRECT_PROMPT_INJECTION]: The skill instructions involve processing external data sources such as env.json and integration manifests. This creates an attack surface where malicious instructions could be embedded in the data processed by the agent. The analysis identifies ingestion points (external JSON files), capability surfaces (dynamic script execution and network fetches), and existing mitigations (CSP gates and domain allow-lists) as relevant evidence for this surface.
[EXTERNAL_DOWNLOADS]: The instructions guide the user to download and install the @devopsnext/starterkit-config-util package from the NPM registry. This is a standard dependency management task involving a well-known service.

starterkit-config-util