The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/changeset-prompt.mjs script interpolates CLI arguments (--base, --head) directly into shell commands executed via execSync. This allows for arbitrary command execution if the arguments contain shell metacharacters.
Evidence: The run function calls execSync(cmd, ...) where cmd is constructed using ${headRef} and ${baseRef} in scripts/changeset-prompt.mjs.
[PROMPT_INJECTION]: The skill processes untrusted input from pull request bodies and git diffs, interpolating them into LLM prompts without sanitization or boundary markers. This creates a surface for indirect prompt injection attacks.
Ingestion points: PR_BODY and PACKAGE_DIFF variables in scripts/changeset-prompt.mjs are sourced from the GitHub event payload and local git repository diffs.
Boundary markers: The prompt template in references/validation-prompt.md lacks delimiters or protective instructions for interpolated content.
Capability inventory: The skill has the ability to execute shell commands via git, write to the file system, and interact with the GitHub API using a GITHUB_TOKEN.
Sanitization: No sanitization, escaping, or validation is performed on the pull request body or diff content before prompt construction.

changeset-validation