The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directly interpolates the $ARGUMENTS variable into shell command strings in SKILL.md. If a user provides a crafted input containing shell metacharacters (e.g., ;, &, |, or backticks), it can lead to arbitrary command execution on the underlying system.
Evidence: PREV_TAG="$ARGUMENTS" is used in multiple subsequent commands: git tag -l "$PREV_TAG", git log ${PREV_TAG}..HEAD, and git diff ${PREV_TAG}..HEAD.
[PROMPT_INJECTION]: The skill facilitates indirect prompt injection by ingesting untrusted data from the git repository's history and pull request metadata.
Ingestion points: The skill reads data from git log and gh pr list in SKILL.md.
Boundary markers: No boundary markers or protective delimiters are used when the agent processes the retrieved commit messages or PR titles.
Capability inventory: The skill possesses the capability to execute shell commands (git, gh) and perform file system writes (CHANGELOG.md).
Sanitization: No sanitization, filtering, or validation is applied to the ingested commit messages or PR descriptions before they are used to generate the changelog or presented to the agent context.

gen-release-notes