The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a local shell script fetch-cc-changelog.sh located in the project's scripts directory. It passes parameters such as --set={latest} where {latest} is a variable populated from external changelog data. This creates a potential command injection vector if the external source provides malicious shell metacharacters that are not sanitized before being passed to the bash command.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external changelog content to drive its analysis and filesystem operations.
Ingestion points: The agent reads the output of the fetch-cc-changelog.sh script, which contains external data from the Claude Code changelog.
Boundary markers: The instructions do not define any delimiters or provide warnings to ignore embedded instructions within the changelog data.
Capability inventory: The skill has the capability to execute shell scripts, perform recursive grep searches across the plugins/elixir-phoenix/ directory, and modify project files like reference_cc_source_internals.md.
Sanitization: There is no indication of sanitization, filtering, or validation of the external changelog text before it is used to influence the agent's logic or filesystem commands.
[DATA_EXPOSURE]: As part of its mapping logic, the skill uses strings extracted from external changelog entries to perform recursive searches across sensitive plugin components. This includes the hooks configuration (hooks.json), all agent frontmatter files, and internal memory files, which could lead to the exposure of sensitive internal project structure or configuration based on external prompts.

cc-changelog