The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script get-versions.py fetches package metadata from api.deps.dev. This is a well-known service provided by Google for open-source package insights and is considered a safe external reference for this utility's purpose.
[DATA_EXPOSURE_AND_EXFILTRATION]: No sensitive local files, credentials, or environment variables are accessed. The only data sent to the external API is the package name provided by the user.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from a public API and presents it to the agent, which is a standard attack surface for indirect prompt injection.
Ingestion points: Package names are accepted via command-line arguments in get-versions.py, and metadata is fetched from the external deps.dev API.
Boundary markers: The output is structured as TSV but lacks explicit instructions for the agent to ignore embedded instructions in the package data.
Capability inventory: The script uses urllib.request.urlopen to perform network requests.
Sanitization: Package names are sanitized using urllib.parse.quote before being interpolated into the API URL.

pkg-versions