The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell-based Git and package manager commands to automate branch management and lockfile updates.
Evidence: SKILL.md contains instructions for the agent to run git cherry-pick, git push, and gh pr list to manage the lifecycle of the pull requests.
Evidence: Step 3 and 4 in SKILL.md invoke tools like npm, yarn, pnpm, bundle, cargo, and poetry to resolve dependencies and verify the repository state.
[EXTERNAL_DOWNLOADS]: The skill facilitates downloads from official package registries when resolving dependency conflicts.
Evidence: The tool uses standard commands like npm install and cargo update which interact with well-known official services such as the npm registry and crates.io.
[PROMPT_INJECTION]: The skill processes external data from GitHub pull requests, creating a potential surface for indirect prompt injection.
Evidence: In Step 1 of SKILL.md, the agent reads title and body fields from open pull requests via the GitHub CLI.
Mitigation: The skill includes an explicit pause for confirmation in Step 1, requiring the user to review the extracted dependency information and provide approval before the tool performs any file edits or branch operations.

wk-renovate