The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the ingestion of unsanitized data from the repository's history and documentation.
Ingestion points: The skill retrieves untrusted data from git commit logs in Phase 2 and reads external content from documentation files located in production/sprints/ and design/gdd/ in Phase 2.
Boundary markers: Absent. The instructions do not define delimiters or provide clear guidelines to the agent to ignore instructions that might be embedded within the ingested commit messages or document text.
Capability inventory: The skill is granted several capabilities including Bash (used for git operations), Write (used to modify docs/CHANGELOG.md in Phase 7), as well as Read, Glob, and Grep for file system access.
Sanitization: Absent. No validation, escaping, or filtering is performed on the content retrieved from git history or project documentation before it is processed by the agent to generate the changelog output.

changelog