The Agent Skills Directory

Verified External Downloads: The skill's prepare-release-assets.ps1 script downloads binary installers and symbol files from Azure DevOps (microsoft/Dart project). This process follows security best practices by validating the assets against ADO-published SHA256 hashes and verifying that executable files carry a valid Microsoft Corporation Authenticode signature before they are included in a release draft.
Indirect Prompt Injection Surface: To generate release notes, the skill ingests pull request titles, bodies, and code diffs. Because this content originates from external contributors, it represents a potential surface for indirect prompt injection. The skill manages this by focusing on local summarization and providing structured instructions for output generation.
Automated CLI Command Execution: The workflow relies on the GitHub CLI (gh), Azure CLI (az), and Git to perform repository management and metadata retrieval. This automation is standard for release engineering and requires the user to have previously authenticated these tools with the appropriate permissions to the vendor's official repositories and build pipelines.
Secure Credential Handling: While the scripts interact with authenticated services, they do not store or hardcode secrets. They leverage standard CLI authentication states (e.g., az account get-access-token) to interact with Azure DevOps and GitHub, ensuring that credentials remain managed by the underlying operating system and official CLI tools.

release-note-generation