The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill parses commit history using git log to generate CHANGELOG.md and automated release notes as described in references/changelog-generation.md. This creates an indirect prompt injection surface where a malicious user with commit access could influence the agent's behavior or output by crafting commit messages containing instructions.
Ingestion points: Commit logs retrieved via git log --oneline in references/changelog-generation.md.
Boundary markers: None identified; commit messages are parsed and directly extracted.
Capability inventory: The skill has write access to the filesystem (git commit), network access (git push), and uses the GitHub CLI (gh release create).
Sanitization: None; instructions prioritize manual curation but do not specify automated sanitization of commit content.
[COMMAND_EXECUTION]: Instructions in references/gitflow-finish-pipeline.md (specifically Phase 3 and Phase 4) recommend interpolating user-supplied input such as $NAME and $VERSION directly into shell command strings without explicit quoting requirements.
Evidence: The pipeline suggests commands like git commit -m "docs: update changelog for $NAME" and bash <skill-dir>/scripts/finish-branch.sh --type feature --name $NAME. If the agent performs direct string interpolation for these values, a malicious user could provide a branch name or version containing shell metacharacters (e.g., feature/name"; rm -rf / #) to execute unauthorized commands.

finish-feature