The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute Python and Node.js code snippets locally to parse and extract data from project configuration files (package.json). These scripts are static and limited to parsing JSON data.
Evidence: Inline scripts using python3 -c and node -e found in references/dep-scans.md and references/react18-scans.md.
[EXTERNAL_DOWNLOADS]: The skill includes commands that query the npm registry to check for peer dependency requirements and package metadata. This is standard behavior for dependency auditing.
Evidence: Usage of npm info in references/dep-scans.md to fetch data from the npm registry.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by instructing the agent to ingest and process untrusted data from the codebase being audited (such as package.json and source code). This data could theoretically be crafted to influence the agent's migration summary.
Ingestion points: package.json and various .js/.jsx source files.
Boundary markers: Not explicitly defined in the provided audit commands.
Capability inventory: The agent has access to standard shell tools (grep, find, npm) as well as local python and node runtimes for the audit.
Sanitization: No sanitization is performed on the content of the files being scanned before being processed by the agent.

react-audit-grep-patterns