changeset-validation

The script's purpose is benign prompt generation, and there is no evidence of data exfiltration or malware. It has a concrete command-injection risk because untrusted refs are interpolated into `execSync` shell commands; package paths are similarly interpolated in Git commands. Use `spawnSync` with argument arrays and validate refs and paths before execution.