The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of system package managers (e.g., npm, pnpm, cargo, pip, uv, go) and CLI tools (e.g., gh, grep, rg) to analyze the project environment and execute the migration steps. In Phase 4, it dynamically generates and runs a test-runner.sh script in /tmp to verify code snippets before applying changes to the main repository.
[REMOTE_CODE_EXECUTION]: The instructions direct the agent to check for and execute official migration tools using npx (e.g., react-codemod, @angular/cli, storybook). This involves downloading and running code from the npm registry at runtime.
[PROMPT_INJECTION]: The skill has an indirect prompt injection attack surface as it ingests and processes untrusted data from the project's source code and external documentation.
Ingestion points: Project source files (SKILL.md, Phase 2) and community/official documentation retrieved via Context7 or web search (SKILL.md, Phase 3).
Boundary markers: There are no specific instructions for the agent to use boundary markers or to ignore potential instructions embedded within the ingested source code or documentation.
Capability inventory: The skill possesses the capability to execute shell commands, perform network operations via the gh CLI, and modify files throughout the repository.
Sanitization: No explicit sanitization or validation steps are defined for the content extracted from external libraries or documentation before it is incorporated into the migration workflow.

vp-deps-migrate