The Agent Skills Directory

[COMMAND_EXECUTION]: The main script scripts/showcase.py retrieves install and serve commands from the user-provided .release-showcase/config.json and executes them using subprocess.run(..., shell=True) and subprocess.Popen(..., shell=True). This allows for arbitrary shell command execution based on the repository's configuration.
[DYNAMIC_EXECUTION]: During the automated recording process, scripts/record.mjs utilizes Playwright's addInitScript to load and execute local JavaScript files specified in clips.json. This mechanism allows for runtime script injection into the browser context.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PR bodies via the gh CLI tool. This data is stored in .media/brief.md and used as primary context for the agent's release notes generation. While the skill performs basic sanitization by removing HTML comments and limiting length, it lacks strict boundaries or instruction-filtering, creating a surface for indirect prompt injection.
[EXTERNAL_DOWNLOADS]: The skill ensures the availability of the Playwright framework and Chromium browser by downloading them to a local cache directory (~/.cache/release-showcase) if they are missing from the environment.

release-showcase