The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to retrieve clear-text passwords and one-time passwords (OTP) from 1Password using the op CLI and pipe them into shell commands (e.g., echo "$PASSWORD" | ...). This practice can expose sensitive credentials in process lists, shell history, or logging systems.
[COMMAND_EXECUTION]: The skill performs several potentially risky command-line operations, including terminating processes with SIGKILL (kill -9) and manually manipulating the PATH environment variable to prioritize specific Ruby versions. It also executes a local shell script (packages/example/runlambda.sh) whose contents are not defined within the skill.
[EXTERNAL_DOWNLOADS]: The bun i command is used to install dependencies, which downloads and executes code from the NPM registry.
[PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by ingesting untrusted data from GitHub (Pull Request titles, authors, and descriptions) to generate a changelog. Malicious content within a PR title could potentially influence the agent's behavior during the changelog generation or release process.
Ingestion points: Data is retrieved via git log, gh pr view, and gh api calls.
Boundary markers: No delimiters or safety instructions are provided to the agent to treat this external content as untrusted data.
Capability inventory: The skill has capabilities to write files to /tmp, create NPM tokens, and execute release scripts.
Sanitization: No sanitization or filtering is performed on the data retrieved from GitHub before it is processed by the agent.

release