The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/release.py script executes Git and user-defined commands using subprocess.run. It uses argument lists rather than shell strings and validates template variables against a strict version regex to mitigate command injection risks.
[CREDENTIALS_UNSAFE]: The skill reads credentials from ~/.env for library publication. It implements a custom parser that specifically blocks shell substitution patterns (such as $() or backticks) and automatically redacts these credentials when running validation checks or artifact verifiers to prevent accidental exposure in logs.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data such as CHANGELOG.md and repository content. It mitigates injection risks by using strict heading matching and regex validation for all version strings, and its capabilities are confined to the defined release workflow.
[DYNAMIC_EXECUTION]: The test suite scripts/test_release.py uses importlib to load the local release script for behavioral testing. This is a standard testing pattern and is restricted to loading the bundled script file.

release-kotlin-library