The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes commit messages and pull request descriptions from git log and gh pr list.
Ingestion points: Git commit history and GitHub pull request bodies (SKILL.md).
Boundary markers: No specific delimiters are used to isolate untrusted content.
Capability inventory: The skill can write to the filesystem, execute local shell scripts, and perform Git/GitHub operations.
Sanitization: There is no evidence of filtering or sanitizing PR content before inclusion in the changelog.
[COMMAND_EXECUTION]: The skill executes several internal shell scripts including ./scripts/release.sh, ./scripts/docker-onboard-smoke.sh, and ./scripts/rollback-latest.sh. It also uses standard development tools like pnpm and npm. These are considered legitimate vendor-owned tools within the framework's context.
[EXTERNAL_DOWNLOADS]: The skill interacts with external services including the npm registry (npm view) and GitHub (gh CLI). These are well-known and trusted platforms, and the operations are used for legitimate package and PR metadata retrieval.

infrastructure