The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple local Python scripts (e.g., verify_release_integrity.py, check_public_docs.py, prepare_release_body.py, and check_release_tag_protection.py) to manage release gates and document state transitions.
[COMMAND_EXECUTION]: It utilizes system and developer utilities including git (for tagging, pushing, and archiving), gh (for GitHub Actions run monitoring and release publication), and python3 (for running unit tests and compilation).
[EXTERNAL_DOWNLOADS]: The workflow uses npx --yes skills to download and execute the 'skills' CLI tool from the npm registry to perform fresh-install verification.
[EXTERNAL_DOWNLOADS]: It fetches and installs content from the vendor's own repository (LightDevCoder/skills) as part of its verification lifecycle.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-controlled data such as project documentation (CHANGELOG.md, RELEASE_NOTES.md) and CI results from GitHub during auditing.
Ingestion points: Reads local Markdown files and external GitHub CLI JSON output in CLOSEOUT.md, DOCUMENT-STATE.md, and RELEASE-STAGES.md.
Boundary markers: Uses structured stage gates and dedicated verification scripts to process data rather than passing raw text directly to agent prompts.
Capability inventory: Significant capabilities including repository write access (git push), release publication (gh release create), and package installation (npx).
Sanitization: Validation is delegated to first-party scripts like prepare_release_body.py and verify_release_integrity.py which are part of the repository codebase.

release-workflow