The Agent Skills Directory

[SAFE]: The skill proactively defines security best practices, including explicit instructions to avoid committing secrets or generated files to the repository history.
[EXTERNAL_DOWNLOADS]: The skill references the gitmoji.dev API and the gitmoji-cli NPM package. These are established community resources used to implement the skill's specific commit message conventions.
[INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface by ingesting and processing data from untrusted sources (git commit logs) to automate decision-making for versioning and release notes.
Ingestion points: Git commit history and log messages used for SemVer bump calculation and release note generation (SKILL.md).
Boundary markers: The skill relies on structured Conventional Commit headers and uppercase BREAKING CHANGE: footers to delimit intent.
Capability inventory: The skill uses git tag, git push --force-with-lease, and gh release create (SKILL.md).
Sanitization: External log content is passed to the GitHub CLI's note generation API rather than being used for shell command construction or dynamic code execution.

git-workflow