The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads external data from the project's changelog to draft release announcements, which creates a potential vector for instructions embedded in the documentation to influence the agent.
Ingestion points: The file packages/salesforcedx-vscode/CHANGELOG.md is read in Step 3 (for polishing) and Step 11 (to compose a Slack post).
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the prompt interpolation steps.
Capability inventory: The skill has the capability to commit and push changes to the repository, trigger GitHub Actions workflows, and send messages via Slack.
Sanitization: The risk is mitigated by explicit human-in-the-loop checkpoints, specifically Step 11 which requires user approval of the drafted Slack post.
[COMMAND_EXECUTION]: The skill relies on shell command execution to perform repository operations.
The detect-state.ts script uses child_process.execSync to execute git and gh commands. It includes input validation using a regular expression (/^release\/v\d+\.\d+\.\d+$/) to ensure that branch names used in command strings are properly formatted as semantic versions, preventing shell injection.
The workflow uses gh workflow run to trigger remote CI/CD pipelines on GitHub infrastructure.

release