The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/invoke.py to call uv run. This command invokes a secondary engine script (kntnt.py) to handle the release logic. The execution uses argument lists rather than shell strings, mitigating command injection risks.
[DYNAMIC_EXECUTION]: The script scripts/invoke.py implements a discovery mechanism that probes multiple application-specific directories (such as ~/.claude/skills and ~/.cursor/skills) to locate the vendor's manager engine at runtime. This allows the skill to operate across different AI agent harnesses.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input and changelog data.
Ingestion points: User input passed to scripts/invoke.py via stdin and changelog content read during the release planning phase.
Boundary markers: The skill uses a structured "Invocation Envelope" with a -- separator to isolate natural language guidance from formal command arguments.
Capability inventory: The skill performs file system modifications (version bumping), git operations (commit, tag, push), and network operations via the gh CLI (GitHub releases).
Sanitization: The release process includes a mandatory plan review and user confirmation step unless explicitly bypassed by the user with the --yes flag.

release