upgrade-js-deps

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill runs npx npm-check-updates and make npm-install, which fetch package metadata and install code from the public npm registry (untrusted third-party packages) and the agent is expected to read and act on that output as part of the upgrade workflow.