The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation in references/guides/ai-agents.md provides an official command to download a skill configuration file from the conventional-changelog/commitlint repository on GitHub. This is the authoritative source for the tool and is considered a safe and well-known repository.
[COMMAND_EXECUTION]: The skill contains various examples of shell commands in the scripts/ and samples/ directories for project setup and commit validation, including npm install, git commit, and npx commitlint. These are routine development tasks and are provided here as legitimate usage examples.
[INDIRECT_PROMPT_INJECTION]: The guide for AI agents (references/guides/ai-agents.md) recommends executing npx commitlint, which ingests untrusted project data such as commit messages and local configuration files (e.g., commitlint.config.js) into the execution context. While configuration files can execute arbitrary JavaScript, this is a core feature of the commitlint tool. The documentation does not include explicit boundary markers or sanitization for these inputs, representing a standard trust chain exposure inherent to using the tool on external codebases.

commitlint