The Agent Skills Directory

[SAFE]: The skill performs Git history rewrites using git push --force-with-lease and --force-if-includes. These are industry-standard safe methods for updating remote history that prevent overwriting work pushed by others during the execution. Additionally, a mandatory verification step (git diff --quiet) ensures that no actual code changes are introduced during the commit message curation.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to manage the local Git environment. It follows security best practices by using quoted heredocs (<<'EOF') when generating commit messages from external data, which prevents shell injection attacks from malicious pull request titles or bodies.
[EXTERNAL_DOWNLOADS]: The instructions mention using npx commitlint to validate the new commit messages. While this involves fetching and executing a Node.js package, the skill explicitly prefers using a local version from the repository's node_modules if available, reducing reliance on remote sources.
[PROMPT_INJECTION]: The skill processes external data such as pull request bodies, review comments, and linked issues to synthesize a commit narrative. While this is an ingestion point for untrusted data, the risk is mitigated by the skill's hard constraints which forbid the agent from altering file contents or performing actions outside the specific PR branch scope.

curate-release