The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text from git commit logs and repository code diffs, creating a potential surface for indirect prompt injection if a contributor crafts a malicious commit message or diff intended to hijack the agent's instructions.
Ingestion points: Ingests untrusted data through git diff (Step 3a) and git log (Step 3b) within SKILL.md.
Boundary markers: Absent. There are no specialized boundary markers or defensive instructions ensuring that data from diffs and logs is isolated from the agent's instruction context.
Capability inventory: Operates native CLI commands via git and gh tools (including git push and gh pr create) as detailed across Steps 1-8 in SKILL.md.
Sanitization: Absent. Raw text inputs from git outputs are parsed directly by the model to determine SemVer increments and draft the release notes.
[COMMAND_EXECUTION]: The skill executes local shell commands using git and gh to perform repository state analysis, branch creation, commits, pushes, and pull request creation. These commands are aligned with the primary purpose of the skill, and safety is increased by requiring explicit user confirmation before executing version updates, branch pushing, or changelog writes.

github-release