The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves reading and acting upon content from project files, which creates a potential vector for indirect prompt injection.
Ingestion points: The agent reads version information from .claude-plugin/plugin.json and parses the CHANGELOG.md file. It is also expected to analyze recent changes (e.g., commit messages or diffs) to determine the appropriate version bump type (patch, minor, or major).
Boundary markers: The instructions lack specific boundary markers or system-level directives that would prevent the agent from following malicious instructions hidden within the changelog or plugin metadata.
Capability inventory: The skill has access to shell execution (jq, git), file system modification (editing version and changelog files), and network operations via git push to the remote repository.
Sanitization: No validation or sanitization logic is implemented to ensure that the content read from the project files does not contain prompt injection attacks.
[COMMAND_EXECUTION]: The skill executes local shell commands to automate the development workflow.
Evidence: The skill uses jq for JSON parsing and git for version control operations (add, commit, tag, push). These tools are used for their intended purpose in a software release context.

release