The Agent Skills Directory

[COMMAND_EXECUTION]: The Python scripts scripts/commit_linter.py and scripts/generate_changelog.py execute the git binary using the subprocess.run method. The implementation correctly passes arguments as a list and does not enable shell interpretation (shell=False), which protects against shell command injection.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of git commit messages and input files. However, it applies regular expression filters (CONVENTIONAL_RE and COMMIT_RE) to validate these inputs against Conventional Commit standards before including them in the generated documentation. The risk is minimized as the tool performs structured parsing rather than raw text interpolation.
[DATA_EXPOSURE]: The skill includes a capability to write to the local filesystem via the --write flag in scripts/generate_changelog.py. This behavior is transparent, documented, and restricted to the specific file paths provided as arguments, representing standard development tool functionality without evidence of malicious intent.

changelog-generator