The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from project-specific files such as CHANGELOG.md, README.md, and manifest files (package.json, Cargo.toml) to automate release metadata generation.
Ingestion points: Project documentation and metadata files within the repository (e.g., CHANGELOG.md, README.md, package.json, Cargo.toml, pyproject.toml).
Boundary markers: The skill includes explicit instructions for the agent to perform a mandatory "Five Question Self-Check" before executing sensitive actions like tagging or creating releases, providing a layer of human-in-the-loop verification.
Capability inventory: The agent can execute git commands (tagging, pushing), gh CLI operations (creating/editing releases, monitoring Actions), and file system writes (README synchronization).
Sanitization: The automation scripts use regular expressions to extract specific versioning and changelog information, which limits the scope of ingested data, though it does not perform full input sanitization of the descriptive text.
[EXTERNAL_DOWNLOADS]: Utility scripts perform network requests to the GitHub API to verify release assets and update documentation links.
Evidence: scripts/check-readme-coverage.py and scripts/update-readme.py use Python's urllib.request to fetch JSON metadata from api.github.com. These operations target a well-known, trusted service and are limited to metadata retrieval, not code execution.
[COMMAND_EXECUTION]: The skill facilitates the execution of shell commands and scripts necessary for software build and release pipelines.
Evidence: The workflow involves running git, gh, npm, pnpm, cargo, and local bash scripts (scripts/build-zips.sh, scripts/build-suite-zips.sh). These scripts perform standard packaging tasks such as git archive, tar, and zip. Notably, scripts/build-suite-zips.sh includes a security feature that scans for and blocks the inclusion of sensitive files (e.g., .env, *.pem, credentials.json) in the final release packages.

release-workflow