The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the user-provided tool name directly using subprocess.run to detect its current version (e.g., executing tool --version).
[COMMAND_EXECUTION]: The skill runs the npm CLI tool with package names that may be derived from user input or specified in the provider registry.
[EXTERNAL_DOWNLOADS]: Fetches release metadata and changelogs from well-known sources including GitHub's public API, npm, and PyPI.
[PROMPT_INJECTION]: The skill processes and summarizes external release notes, creating a surface for indirect prompt injection.
Ingestion points: scripts/fetch_releases.py fetches release bodies and metadata from GitHub, npm, and PyPI.
Boundary markers: None. Summarized release notes are incorporated into the Markdown output without explicit delimiters or instructions to ignore embedded content.
Capability inventory: The skill has command execution capabilities via subprocess.run in scripts/resolve_source.py (tool execution) and scripts/fetch_releases.py (npm execution).
Sanitization: scripts/summarize_changes.py implements basic character and link cleaning but does not sanitize against malicious prompt instructions within the release notes.

cli-upgrade