The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill directs the agent to read existing changelog fragments to match their tone and structure, creating a surface for indirect prompt injection from untrusted project files.
Ingestion points: Files located in changelogs/fragments/ and changelog.d/.
Boundary markers: The instructions do not define delimiters or provide warnings to ignore embedded instructions in the ingested files.
Capability inventory: The agent has Bash access to execute package managers and changelog tools, alongside file writing capabilities.
Sanitization: The skill lacks explicit sanitization or validation steps for the content read from fragment files.
[EXTERNAL_DOWNLOADS]: The skill provides procedures for installing and running third-party Python packages including antsibull-changelog, towncrier, and scriv from external registries.

python-changelog-fragments