The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes command-line tools including git, npm, and the GitHub CLI (gh) to perform version bumping, git tagging, and package publishing. These are standard operations for the skill's stated purpose.\n- [EXTERNAL_DOWNLOADS]: The skill configures GitHub Actions workflows that fetch official components such as actions/checkout and actions/setup-node from GitHub's official repository. It also performs dependency installation via npm install or npm ci from the well-known npm registry.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes project metadata from package.json and workflow context from GitHub environment variables, which represents a surface for indirect prompt injection.\n
Ingestion points: Project metadata (version, name) in package.json and the GITHUB_REF_NAME variable in workflow templates.\n
Boundary markers: No explicit prompt boundary markers are provided, but the workflow includes a structural validation step to ensure the git tag matches the package version before proceeding with a release.\n
Capability inventory: File system writes (updates to package.json and workflow files), git operations (tagging, pushing), and network publishing (npm publish, gh release).\n
Sanitization: Package metadata is extracted via standard JSON parsing (node -p). The skill explicitly instructs the agent to manually verify command outputs and obtain user authorization for all irreversible actions, reducing the likelihood of executing malicious payloads embedded in project data.

npm-release