The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits surfaces for both direct and indirect prompt injection.
Direct Injection: The SKILL.md file passes the raw $ARGUMENTS variable directly into the agent's instructions, which could be used to override agent behavior if the input is not sanitized.
Indirect Injection (Category 8): The skill ingests untrusted data from multiple sources to influence its execution.
Ingestion points: $ARGUMENTS in SKILL.md; project configuration files like package.json, Cargo.toml, Makefile, and pyproject.toml in references/gitflow-finish-pipeline.md; and git commit history via git log in references/changelog-generation.md.
Boundary markers: No explicit boundary markers or "ignore embedded instructions" warnings are used when processing external data.
Capability inventory: The skill possesses extensive capabilities including shell command execution (bash), git operations (git push, git fetch), and GitHub CLI operations (gh).
Sanitization: There is no evidence of sanitization for branch names, commit messages, or dynamically identified test commands before they are executed or passed to the agent's context.
[COMMAND_EXECUTION]: The skill relies heavily on shell command execution to perform its tasks.
It executes a bundled bash script (scripts/finish-branch.sh) to handle git-flow operations.
It dynamically identifies and runs test suites based on the presence of common project files (e.g., executing npm test, pytest, or cargo test).
It uses complex command pipelines for branch cleanup, involving grep, sed, and xargs (as seen in references/cleanup.md).

finish-release