The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/collect_release_evidence.py executes various git subcommands including rev-parse, ls-tree, show, log, and diff-tree using the subprocess.run function.
The implementation uses a list-based argument format ["git", *args], which prevents standard shell command injection as it does not invoke a shell environment.
The execution is scoped to the local repository path provided by the user or the current directory.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from the repository's git history (commit subjects and file contents) to classify changes for release notes.
Ingestion points: Commit messages and file content are read via git log and git show in the scripts/collect_release_evidence.py script.
Boundary markers: The SKILL.md instructions explicitly state that the output should be treated as an "evidence index, not publication-ready copy" and the script output labels groups as "candidates."
Capability inventory: The script is limited to read-only git operations; it does not contain network access, file-writing capabilities, or generic eval/exec calls.
Sanitization: The skill lacks explicit sanitization for commit message content but mitigates risk by requiring the agent to verify every claim against public docs, API types, and source code before inclusion in the final draft.

draft-release-notes