The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest external, untrusted data from GitHub PRs and issues to draft release notes. A malicious actor could include instructions within these public fields to influence the agent's output or behavior during the release process.
Ingestion points: Data is fetched via gh pr view, gh issue view, and gh api for comments in SKILL.md (Phase 1, Steps 1 and 2).
Boundary markers: No specific delimiters or instructions to ignore embedded commands are used when processing this data.
Capability inventory: The agent has permissions to execute shell commands (git, gh, bun, npm) and write to the local file system.
Sanitization: The instructions do not specify any validation or sanitization of the fetched content before it is incorporated into the release notes.
[COMMAND_EXECUTION]: The skill requires the execution of various local commands to manage the repository and build the software. This is consistent with its primary purpose as a release manager.
Evidence: Use of git tag, git push, and bun run build:* throughout SKILL.md.
[EXTERNAL_DOWNLOADS]: The release notes templates provided in the skill instructions and references contain commands to download installation scripts from the vendor's domain.
Evidence: curl -fsSL https://plannotator.ai/install.sh and irm https://plannotator.ai/install.ps1 in SKILL.md and reference files.
[REMOTE_CODE_EXECUTION]: The installation instructions drafted by the skill involve piping remote scripts directly into system shells (bash and powershell/iex). While these target vendor-controlled domains, they represent a high-privilege execution pattern.
Evidence: curl ... | bash and irm ... | iex patterns in SKILL.md Phase 3 and reference files.

release-plannotator