The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and run the claude-flow and claude-flow@alpha packages at runtime to perform release tasks. It also recommends using npm install to set up the development environment.- [COMMAND_EXECUTION]: Extensive use of shell execution via Bash() and various CLI tools including gh (GitHub CLI), git, npm, and docker for orchestrating complex release pipelines.- [REMOTE_CODE_EXECUTION]: Runtime execution of external code is performed using npx claude-flow, which fetches and runs packages from the npm registry without pinning specific hashes or verifying integrity in the instructions.- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external data to automate release documentation.
Ingestion points: Untrusted commit messages and pull request metadata (titles, labels) are fetched from the GitHub API via gh api and gh pr list.
Boundary markers: The instructions do not define boundary markers or delimiters to isolate ingested commit data from the generated documentation templates.
Capability inventory: The skill has significant capabilities including file writing (Write), shell command execution (Bash), and GitHub API interactions (gh release create, gh pr create).
Sanitization: No sanitization or validation steps are identified for the data extracted from commits before it is used to populate RELEASE_CHANGELOG.md and subsequent release notes.

github-release-management