The Agent Skills Directory

Indirect Prompt Injection Surface: The skill ingests raw markdown content from release notes, which typically contains externally-sourced text. This data is used to generate summarized highlights and is written to changelog files. Since the input may contain untrusted content, there is a risk of indirect prompt injection where malicious instructions embedded in the notes could influence the agent's processing. Ingestion points: BODY input variable in SKILL.md. Boundary markers: Absent; the skill lacks explicit instructions to treat the BODY content as data only. Capability inventory: File system write access to docs/changelogs/ and execution of npm commands. Sanitization: Limited to link reformatting, which does not prevent text-based injection.
Execution of Shell Commands: The process concludes with commands such as npm run format and npm install. These commands are standard for maintaining code style but represent an execution surface. It is recommended to ensure that the environment and configuration files are trusted before these automated tasks are allowed to run.

docs-changelog