The Agent Skills Directory

Indirect Prompt Injection Surface: The skill generates prompts for evaluation by interpolating content from external sources, including pull request descriptions and git diffs. An attacker could potentially embed instructions within these sources to influence the validation verdict.
Ingestion points: scripts/changeset-prompt.mjs reads the pull request body from the GitHub event payload and retrieves file diffs using git commands.
Boundary markers: The prompt template in references/validation-prompt.md uses delimiters and structured sections to separate context from instructions, which helps mitigate accidental interpretation.
Capability inventory: The skill possesses capabilities for command execution (git), file writing (via the --output flag), and network interaction with the GitHub API.
Sanitization: External content is interpolated directly into the prompt without specific escaping or filtering.
Command Execution via Shell: The script scripts/changeset-prompt.mjs uses execSync to run git commands with arguments derived from command-line options and environment variables. While necessary for the skill's functionality, this pattern requires that inputs be carefully managed to avoid command injection if the script were to be invoked with unsanitized arguments.
External Data Retrieval: The script scripts/changeset-assign-milestone.mjs makes authenticated requests to the official GitHub API (api.github.com) to retrieve and update milestone information. This represents normal operation for repository management tools using provided GitHub tokens.

changeset-validation