The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes npx to download and execute claude-flow and its alpha versions (npx claude-flow@alpha) directly from the npm registry. This practice introduces external code into the execution environment at runtime.
[COMMAND_EXECUTION]: Several examples in the skill demonstrate the use of subshell expansion within the Bash tool, such as $(cat RELEASE_NOTES.md) and $(cat RELEASE_CHANGELOG.md). This pattern allows the content of these files—which are generated from potentially untrusted sources like git commit messages and PR titles—to be evaluated by the shell. If the files contain shell metacharacters like backticks or $(), it could lead to arbitrary command execution.
[REMOTE_CODE_EXECUTION]: The skill's core functionality relies on npx to run remote CLI tools and orchestrate complex AI agent swarms (mcp__claude-flow__swarm_init), effectively executing logic fetched from remote sources.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection by ingesting data from GitHub commits and pull requests.
Ingestion points: Data enters the agent's context through gh api and gh pr list commands, which are then used to populate CHANGELOG.md and RELEASE_NOTES.md.
Boundary markers: No explicit boundary markers or instructions are provided to the agent to treat this ingested data as untrusted.
Capability inventory: The skill possesses extensive capabilities including Bash command execution, file writing, and agent spawning/coordination.
Sanitization: The instructions do not include logic to sanitize or escape the content of commit messages or PR descriptions before they are passed into shell commands or used in release notes.

github-release-management