The Agent Skills Directory

[COMMAND_EXECUTION] (SAFE): The skill performs shell-based auditing and update tasks. Evidence: It executes npm ls and npm view to determine installed versus latest versions of packages. It runs grep to scan the codebase for deprecated API signatures. It uses npm install and pnpm add for package management. These actions are restricted to specific, non-arbitrary commands necessary for the skill's purpose.
[EXTERNAL_DOWNLOADS] (SAFE): The skill manages remote dependencies. Evidence: It updates core libraries from the npm registry. It suggests the use of npx shadcn@latest add to fetch UI components from https://r.assistant-ui.com/thread. While this involves downloading code from a third-party domain, the behavior is a documented feature of the framework's migration process (moving from internal UI packages to local registry-based components).
[PROMPT_INJECTION] (LOW): The skill has an indirect injection surface. Evidence: 1. Ingestion points: The agent reads and interprets the output of npm and grep commands from the local filesystem. 2. Boundary markers: No explicit delimiters or instructions to ignore embedded content are provided. 3. Capability inventory: The skill can modify the project's source code and configuration. 4. Sanitization: No sanitization is performed on input data. However, as these inputs come from the local development environment or official package registries, the risk is minimal and characteristic of migration tools.

update