The Agent Skills Directory

[SAFE]: The skill performs discovery of software versions by reading local project manifests such as package.json, Cargo.toml, and pyproject.toml, which is standard behavior for its intended purpose.
[SAFE]: It references and fetches data from well-known external services including GitHub, npm, PyPI, and security databases like OSV.dev to provide accurate upgrade recommendations.
[COMMAND_EXECUTION]: The skill instructions direct the agent to run various system diagnostic tools such as kubectl, npm ls, django-admin check, and govulncheck. These tools are utilized to audit the runtime error surface and verify the health of the system post-upgrade, which is relevant to the skill's primary purpose.
[SAFE]: The skill ingests external content from changelogs and migration guides. While this creates a potential surface for indirect prompt injection, the behavior is intrinsic to the skill's primary task of analyzing software release notes.
Ingestion points: Remote changelogs and migration guides fetched from external URLs during the delta analysis phase.
Boundary markers: No explicit delimiters or instruction-bypass warnings are defined for the ingested text.
Capability inventory: Includes reading local files, performing network requests to package registries, and executing system diagnostic tools across multiple language environments.
Sanitization: No specific filtering or escaping mechanisms are described for the processed external text.

upgrade-advisor