The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several local Git commands to inspect repository state, including git status, git diff, git describe, and git tag.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted data from repository commits, file diffs, and existing changelogs to generate release notes.
Ingestion points: Git commit messages, repository diffs, and external files like CHANGELOG.md and package.json (SKILL.md).
Boundary markers: The instructions mandate relying on physical repository evidence and forbid the agent from inventing behavior, which acts as a logical constraint against injection, though not a technical sandbox.
Capability inventory: The skill can read and write files and execute Git commands, but it does not have network access or arbitrary code execution (eval/exec) capabilities.
Sanitization: There is no explicit sanitization or filtering of the content read from commit messages before it is processed.

release-versioning