The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The prepare-server.sh script invokes npx to download and execute the conventional-changelog-cli package from the NPM registry. This is a standard development practice for generating changelogs from commit history using a well-known utility.\n- [INDIRECT_PROMPT_INJECTION]: The skill generates release notes by processing commit messages, which represents an ingestion point for potentially untrusted data. \n
Ingestion points: Git commit history retrieved via git log in preflight.sh.\n
Boundary markers: None explicitly defined in the data ingestion scripts, though the SKILL.md provides selection logic for the agent.\n
Capability inventory: File system writes (apps/core/RELEASE_NOTES.md), git operations (git commit, git tag, git push), and remote publishing (pnpm publish).\n
Sanitization: None; the agent is instructed to rewrite commit messages into user-facing language.\n- [COMMAND_EXECUTION]: The provided scripts automate various shell commands including git, npm, pnpm, and gh. These commands are used as intended for managing project releases, checking CI status, and publishing artifacts.\n- [CREDENTIALS_UNSAFE]: The release scripts perform a routine check for active NPM sessions using npm whoami. This is a best-practice verification step to ensure the environment is correctly configured for publishing and does not involve the exfiltration of credentials.

release-core