The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to process external configuration files and tool outputs which represent a potential attack surface for indirect prompt injection.
Ingestion points: Reads package.json, CHANGELOG.md, latest.yml, electron-builder.yml, and command outputs from pnpm audit and git tag.
Boundary markers: None identified for processing these data sources.
Capability inventory: The skill uses the Bash tool and provides patterns for git push, pnpm install, and custom signing scripts.
Sanitization: No explicit sanitization or validation of version strings or changelog content is defined before use in shell commands or Git operations.
[DYNAMIC_EXECUTION]: The skill provides a template for a Windows signing script (scripts/sign-windows.js) that uses child_process.execSync to dynamically execute commands.
The script interpolates environment variables (DIGICERT_KEYPAIR_ALIAS, DIGICERT_CERTIFICATE_FINGERPRINT) directly into a shell command, which could be exploited if these variables are compromised or improperly handled.
[COMMAND_EXECUTION]: The skill frequently utilizes shell command execution as part of its primary function.
Instructions include running pnpm commands, gpg signing, and custom signing tool CLIs via execSync.
The GitHub Actions workflow pattern utilizes multiple run steps to execute build and release logic.

electron-release