The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses a local script (scripts/cover.mjs) to generate SVG files. This script takes a file path as a command-line argument, which the agent is instructed to construct using a 'slug' derived from external data. This creates a path traversal risk, as a malicious slug (e.g., containing ../ sequences) could allow the script to create or overwrite files outside the intended public/changelog/ directory.
[INDIRECT_PROMPT_INJECTION]: The skill's core workflow involves ingesting and processing untrusted data from external sources such as Git logs and GitHub Pull Request (PR) bodies. If these sources contain malicious instructions, they could hijack the agent's behavior.
Ingestion points: Untrusted data enters the agent's context through git log --since=<date> --oneline and gh pr view NNN commands as defined in the Workflow section of SKILL.md.
Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" warnings for the agent when processing retrieved PR content.
Capability inventory: The agent has the capability to execute shell commands (pnpm, git, gh, node), run a script that performs file system writes (scripts/cover.mjs), and execute local development workflows (pnpm dev).
Sanitization: No sanitization or validation is applied to the data retrieved from PR bodies before it is used to generate the changelog article, title, or file slugs.

bklit-changelog