The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents the configuration and use of lifecycle hooks (e.g., before:init, after:bump, after:release) that execute arbitrary shell commands. This is a primary, intended feature of the release-it CLI tool for release automation tasks like testing and building.
[REMOTE_CODE_EXECUTION]: The configuration reference describes an extends property powered by the c12 library, which allows fetching and applying configuration from remote sources including GitHub repositories and HTTPS URLs.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external, untrusted data to generate changelogs and release notes, which could contain malicious instructions.
Ingestion points: Git commit history (git log), Pull Request metadata, and Issue descriptions from GitHub/GitLab APIs.
Boundary markers: The skill does not explicitly define delimiters or 'ignore' instructions for the agent when processing these data streams; content is interpolated via template variables like ${changelog}.
Capability inventory: The skill supports shell command execution (hooks), file system writes (bump), and authenticated network operations (npm publish, github.release).
Sanitization: The instructions do not specify sanitization or validation routines for commit messages or PR content before they are incorporated into the agent's workflow.
[EXTERNAL_DOWNLOADS]: The documentation encourages the installation and use of various official and community-maintained plugins and companion tools from the npm registry (e.g., @release-it/conventional-changelog, @release-it/bumper, git-cliff) and references JSON schemas hosted on unpkg.com.

release-it