The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository fragments and commit history that could contain malicious code or instructions.
Ingestion points: The agent is instructed in SKILL.md (Phase 3a) to read fragments from the changelog/ directory and extract content from CHANGELOG.md at a specified git reference.
Boundary markers: The skill does not implement boundary markers or instructions to ignore embedded commands within the processed data.
Capability inventory: The agent has access to shell execution via uv, git, and gh, and can perform file-write operations.
Sanitization: No sanitization or sandboxing is performed on the extracted code snippets before the agent is directed to execute them.
[DYNAMIC_EXECUTION]: The skill workflow requires writing and executing Python scripts based on content found in the data files being processed.
Evidence: Phase 5b in SKILL.md instructs the agent to save snippets to /tmp and execute them using uv run to capture real program output for the release notes.
[COMMAND_EXECUTION]: The skill and its included helper script perform multiple shell operations to interact with the git repository and GitHub services.
Evidence: SKILL.md uses shell commands for branch resolution and managing GitHub Gists. The scripts/list_contributors.py script uses subprocess.run to execute git log, git show, and gh api for metadata analysis and affiliation checking.

warp-release-notes