The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Git history which could contain malicious instructions designed to influence the agent's behavior during the changelog generation process.
Ingestion points: The skill ingests commit subjects and bodies via git log, net diffs through git diff, and existing CHANGELOG.md content (SKILL.md, Step 4).
Boundary markers: The instructions lack explicit delimiters (e.g., XML tags or unique markers) to separate the untrusted data from the agent's instructions, increasing the risk that a malicious commit message could be interpreted as a command.
Capability inventory: The skill has permissions to write to the file system (CHANGELOG.md) and execute shell commands via Git and PowerShell (SKILL.md, scripts/resolve-release-scope.ps1).
Sanitization: The instructions mitigate this by requiring the agent to summarize and curate facts rather than including commit logs verbatim, and by implementing a confirmation gate for worktree changes (SKILL.md, Step 3, Step 6).
[COMMAND_EXECUTION]: The skill relies on the execution of local PowerShell scripts and Git commands to perform repository analysis.
Evidence: It invokes scripts/resolve-release-scope.ps1 and scripts/resolve-release-entity.ps1 using pwsh -NoProfile -File, alongside various git subcommands (rev-list, diff, cat-file). These scripts are bundled with the skill and appear to be purpose-built utilities for repository state classification.

git-keep-a-changelog