The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from git commit logs and issue descriptions to generate release documentation.
Ingestion points: Commit messages and subjects collected via git log and git show (SKILL.md, Step 3).
Boundary markers: Absent. The instructions do not provide delimiters or specific directives for the agent to treat the collected commit text as inert data, which could allow malicious instructions inside a commit message to influence the agent.
Capability inventory: The skill utilizes file system write capabilities to modify plugins/baser-core/VERSION.txt (Step 11) and executes shell commands via git.
Sanitization: No sanitization or validation of the ingested commit content is performed before it is formatted and written to the version file. The skill specifically instructs the agent to write directly to the file without presenting a draft for user confirmation.
[COMMAND_EXECUTION]: The skill requires the execution of multiple shell commands to interact with the repository's git history.
Evidence: The skill uses git rev-parse, git tag, git log, git show, and git diff to determine branch state, list versions, and collect changes. These commands are restricted to standard git operations consistent with the skill's primary purpose of release note generation.

basercms-release-note