The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automates release tasks by executing local maintenance scripts (bump-version.mjs, preflight.mjs) using Node.js, and leverages system tools including git and gh (GitHub CLI) for tagging and publishing releases.
[REMOTE_CODE_EXECUTION]: The validation process in scripts/preflight.mjs executes npx --yes skills-ref, which downloads and runs the skills-ref package from the public NPM registry to verify skill integrity.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface within its preflight logic.
Ingestion points: The script reads metadata from skills/heptabase-cli/SKILL.md via fs.readFile.
Boundary markers: Absent; there are no delimiters or instructions to ignore embedded content during parsing.
Capability inventory: The skill has access to the agent's terminal and explicitly instructs the agent to run generated commands.
Sanitization: Metadata is matched using a regular expression and directly interpolated into a recommended gh release command without shell escaping or validation of the content.

release