The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from git history and code diffs to generate PR descriptions and changelogs.
Ingestion points: The skill executes git log and git diff in SKILL.md to collect data for LLM processing.
Boundary markers: Absent. The markdown templates in templates/pr-description.md use simple placeholders like {summary} which do not provide structural isolation for potentially malicious instructions embedded in commit messages or code comments.
Capability inventory: The skill utilizes subprocess calls for git operations, version bumping, and publishing, as well as file writing for changelog updates.
Sanitization: No sanitization or instruction-ignoring wrappers are applied to the git metadata before it is passed to the generation process.
[COMMAND_EXECUTION]: The skill's primary functionality relies on executing a wide range of shell commands for repository management, including branch deletion (git branch -D), hook installation, and CLI tool usage (gh release, npm version).
[EXTERNAL_DOWNLOADS]: The skill encourages the use of several external packages and tools for automation.
Packages: Recommends installing husky, standard-version, commitlint, and semantic-release via npm and npx.
Tools: Recommends standard developer utilities such as eslint, prettier, ruff, and gitleaks for hook-based validation.

git-workflows