The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run build and lint commands such as npm run lint, npx tsc, and npm run build inside a cloned external repository (Branch B). This represents a risk as the repository's configuration files (like package.json) could contain malicious commands defined by an attacker, which would then be executed with the agent's privileges.\n- [EXTERNAL_DOWNLOADS]: The skill clones repositories from GitHub using the gh CLI. While GitHub is a well-known service, the skill does not verify the integrity or safety of the repository content before executing build scripts from it.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text from GitHub commit messages and pull request descriptions. This data is interpolated into generated changelog articles and new pull request descriptions for other repositories.\n
Ingestion points: Commit history fetched via gh api and merged PR lists.\n
Boundary markers: Includes instructions to treat the text as untrusted and to summarize rather than execute instructions.\n
Capability inventory: Network access via gh, repository management via git, and script execution via npm/npx.\n
Sanitization: Relies on prompt-level instructions to ignore embedded commands and perform summarization.\n- [DATA_EXFILTRATION]: In the cross-repo mode (Branch B), the skill pushes generated content to an external repository. If the configuration in memory/docs-sync.md or the ${var} input is manipulated by an attacker, it could lead to the exfiltration of changelog data or other information to an unauthorized repository.

changelog