The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and processes external, potentially untrusted data to generate changelogs and release notes.
Ingestion points: The skill ingests commit subjects and bodies via git log and git describe (SKILL.md). It also reads repository manifest files such as package.json, Cargo.toml, and pyproject.toml to extract version information.
Boundary markers: Instructions require the agent to parse commits into specific structured sections (Added, Changed, Fixed, Removed, Other). While this provides a template, it does not inherently sanitize malicious instructions embedded within the commit text.
Capability inventory: The skill possesses broad capabilities including executing Bash commands, reading and writing to the local filesystem (Read, Write, Edit), and calling other skills (Skill).
Sanitization: The skill implements a robust "Preview and confirm" phase that is described as a "mandatory" and "interactive only" gate. This human-in-the-loop requirement is the primary defense against the agent autonomously following instructions hidden in commit messages.

releasekit