The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes untrusted commit messages retrieved from git history, stdin, or external files.\n
Ingestion points: Commit subjects are ingested and parsed in scripts/commit_linter.py and scripts/generate_changelog.py.\n
Boundary markers: No explicit delimiters or instructions are used to separate the processed commit content from the agent's context, which could allow instructions within commit messages to influence agent behavior.\n
Capability inventory: The skill can execute shell commands (git) and perform file writes (prepending to changelog files).\n
Sanitization: The scripts use regular expressions to validate the conventional commit format, which acts as a filter but does not fully neutralize the risk of embedded instructions in the summary field.\n- [COMMAND_EXECUTION]: The Python scripts execute git commands via the subprocess module to retrieve commit data.\n
Evidence: Both scripts/commit_linter.py and scripts/generate_changelog.py use subprocess.run to call git log.\n
Security Note: While the scripts use a list of arguments and avoid shell=True to prevent shell injection, the git references provided as command-line arguments (e.g., --from-ref, --to-ref) are not strictly validated, presenting a risk of argument injection if malicious flags are passed as references.

changelog-generator