The Agent Skills Directory

[SAFE]: The skill instructions and associated Node.js scripts were analyzed and found to be free of malicious patterns. The scripts perform local text processing and validation tasks only.
[COMMAND_EXECUTION]: The skill involves running local JavaScript files using Node.js to validate changelog drafts. These scripts (check-all.mjs, check-voice.mjs, etc.) only read the specified draft file and output a status report to the console. They do not perform any network operations, unauthorized file system modifications, or subprocess calls.
[INDIRECT_PROMPT_INJECTION]: The skill processes external draft files which could potentially contain malicious instructions. The risk is assessed as safe because the skill's capabilities are limited to text processing and validation; it lacks the network or execution permissions to carry out dangerous actions. Evidence chain: 1. Ingestion points: scripts/check-all.mjs reads draft files via the parseDraft function in scripts/parse.mjs. 2. Boundary markers: The draft format uses '### ENTRY' and '### END' delimiters to structure input. 3. Capability inventory: Scripts are limited to reading local files via node:fs and printing to stdout. 4. Sanitization: No explicit sanitization is performed, as the input is only used for pattern matching and linting.

changelog-writer