The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external and potentially untrusted data from a repository to generate release notes, which could be exploited to influence agent behavior through embedded instructions.
Ingestion points: The skill reads project manifests (such as package.json, Cargo.toml, or tauri.conf.json), changelog files (e.g., CHANGELOG.md, docs/releases.md), and repository diffs or outputs from other tools like describe-changes (via Step 1 of the Procedure).
Boundary markers: There are no explicit instructions or delimiters defined to separate the untrusted input data from the skill's own operational instructions, nor are there warnings to the model to ignore instructions embedded in the ingested content.
Capability inventory: The skill possesses the Bash, Write, Edit, and Grep tools. It is instructed to perform repository-wide modifications (Step 5 and 7) and execute release commands such as npm publish, git tag, and forge release creations.
Sanitization: The skill lacks any specific sanitization, filtering, or escaping logic for the data it reads from the repository before interpolating it into its workflow.
[COMMAND_EXECUTION]: The skill explicitly instructs the agent to use the Bash tool to perform sensitive operations. These include publishing packages to registries (npm/pnpm/yarn publish), creating version control tags (git tag), and interacting with forge CLI tools (gh release create, glab release create). While these actions are central to the skill's purpose, they represent a significant capability surface that relies on the integrity of the release note content generated from ingested project data.

release-notes