The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses various standard development tools including git, gh (GitHub CLI), npm, and curl to manage the release process. These commands are integral to the stated purpose of the skill (versioning, tagging, and publishing) and are used in accordance with security best practices, such as explicitly instructing the agent to avoid logging or printing private keys and secrets.
[EXTERNAL_DOWNLOADS]: The skill fetches status information from baocut.com and GitHub APIs for verification purposes. These are official project resources and well-known services associated with the skill's author. Additionally, it uses npx to run the Cloudflare wrangler utility for accessing worker logs, which is a standard industry tool.
[INDIRECT_PROMPT_INJECTION]: The skill processes commit messages and GitHub Pull Request data to generate release notes. This introduces a potential attack surface where malicious input in external source data could attempt to influence the agent's output. However, the skill provides detailed instructions for manual review, batch summarization, and reconciliation against a source ledger to mitigate these risks.
Ingestion points: Uses git log, git rev-list, and GitHub API calls to retrieve PR details in references/release-notes.md.
Boundary markers: The instructions require the agent to summarize changes in batches and compare them against a complete commit inventory, though no technical delimiters for the prompt itself are specified.
Capability inventory: The skill utilizes git push, gh release edit, and platform-specific npm packaging scripts.
Sanitization: The instructions emphasize a comprehensive inventory of all commits (including internal ones) and reconciliation of the final changelog to ensure full coverage and accuracy.

bcut-release