The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes numerous files from the target repository (e.g., composer.json, README.md, Documentation) which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: composer.json, README.md, CHANGELOG.md, Documentation/, .github/workflows/, Build/Scripts/runTests.sh, phpstan.neon*, .php-cs-fixer*.php, phpunit*.xml*, Tests/, Configuration/, Resources/Private/, Resources/Public/, and Resources/Private/Language/.
Boundary markers: The instructions do not define specific delimiters or "ignore" instructions for the content being read from these files.
Capability inventory: The skill can execute git commands (tag, fetch, status), ddev commands (composer, test runners), and local shell scripts found within the project.
Sanitization: No explicit sanitization or validation of the ingested file content is performed before processing or generating summaries.
[COMMAND_EXECUTION]: The skill guides the agent to execute shell commands and local scripts as part of the release workflow. Specifically, it mentions executing scripts/validate_docs.sh and scripts/render_docs.sh if they exist in the target project. Executing scripts provided by a target repository poses a risk if those files have been tampered with or are malicious.

typo3-initial-release