The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute migration tools (codemods) from the npm registry, such as react-codemod, @next/codemod, and jest-codemods. It also utilizes standard package managers (npm, pip, cargo, go, swift, bundler) to download and update project dependencies from their respective official registries.
[COMMAND_EXECUTION]: The skill executes a variety of command-line tools to perform its tasks, including rg (ripgrep) for codebase searching, package managers for installation, and ecosystem-specific migration utilities like cargo fix and pyupgrade.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from web search results (migration guides, changelogs, and GitHub releases). This data is processed by the agent to identify breaking changes and suggested code modifications, creating an attack surface where malicious instructions could be embedded in external documentation.
Ingestion points: Web search results for migration documentation and changelogs (Phase 3).
Boundary markers: None explicitly specified for web-fetched content within the skill instructions.
Capability inventory: File system reads/writes via apply_patch, and command execution via package managers and npx (Phase 5 & 6).
Sanitization: The skill relies on the agent's internal processing of search results; no explicit sanitization or validation of the external content's instructions is defined.

update-dependencies