The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata such as changelog entries, PR titles, and commit subjects which could contain malicious instructions designed to influence agent behavior at release time.
Ingestion points: SKILL.md (Trust Boundary)
processes log text, PR titles, and tag annotations.
Boundary markers: Present. Instructions specify to ignore embedded instructions and treat text as data only, avoiding wholesale pasting of untrusted logs.
Capability inventory: Includes git operations, shell-based cleanup commands, and execution of repository-defined build/release scripts.
Sanitization: Present. The skill mandates composing release notes manually and explicitly instructs the agent to report any embedded commands found in log text.
[DYNAMIC_EXECUTION]: The skill involves the execution of local repository scripts for verification, auditing, and publication gates.
Evidence: Phase 4 and Phase 5 refer to executing "the full local gate" and "release scripts". The risk is mitigated by a rule requiring that these scripts are sourced from the "trusted base branch", preventing execution of code from unreviewed release candidate commits.
[COMMAND_EXECUTION]: The skill employs various shell commands and git subcommands to manage the release lifecycle and perform disk maintenance.
Evidence: Phase 7 (Reclaim the leftovers) uses commands like git branch -D and git worktree remove to prune temporary development artifacts and build directories to prevent disk exhaustion.

release