The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it processes untrusted data from external sources to drive agent decisions.
Ingestion points: The skill fetches release metadata (release-context.md) and raw git diffs (release-diff.patch) from upstream repositories (openai/codex and sst/opencode) as described in the Steps section of SKILL.md.
Boundary markers: There are no documented delimiters or instructions to the agent to ignore potentially malicious commands embedded within the fetched code diffs or metadata.
Capability inventory: The skill has the capability to execute scripts (codex-release-monitor.mjs), write to the local file system (.github/release-watch/state.json), and create GitHub issues using an OPENCODE_API_KEY.
Sanitization: There is no mention of sanitization or validation of the content retrieved from external repositories before it is passed to the AI agent for analysis.
[COMMAND_EXECUTION]: The skill documentation provides examples of manual execution using the bun runtime to run local maintenance and monitoring scripts.
Evidence: bun run scripts/codex-release-monitor.mjs --repo openai/codex --tag latest is listed under Common Commands.

release-watcher