The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run the skills CLI tool using standard package runners (npx, pnpm dlx, or bunx). This tool is used for inventory management and updating project dependencies from the vendor's official sources.\n- [DYNAMIC_EXECUTION]: The skill includes a Python utility (sync_companion_agents.py) to manage agent metadata. The script employs secure file-handling patterns, such as using temporary files for atomic writes and verifying that all file operations are restricted to the local project directory to prevent path traversal.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes manifest files and agent definitions provided by other skills. It mitigates potential injection risks by enforcing ownership checks through a lockfile system (skills-lock.json) and validating agent names against strict patterns.\n- [SAFE]: The Python test suite (tests/test_sync_companion_agents.py) uses subprocess.run to execute the utility script for verification purposes. This is a standard development practice and is confined to the testing environment.

update-project-skills