The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, specifically Pull Request titles, descriptions, and commit history retrieved via the list_repo_pulls and compare_branches_tags tools.
Ingestion points: Data enters the agent's context through the output of Gitee MCP tools during Steps 3 and 4 in SKILL.md.
Boundary markers: The instructions do not define clear delimiters or specific instructions for the agent to ignore potentially malicious commands embedded within PR titles or commit messages.
Capability inventory: The skill possesses the capability to perform write operations via the create_release tool in SKILL.md.
Sanitization: There is no mention of sanitizing or filtering the PR content before it is interpolated into the changelog or the release body.
Mitigation: The skill includes a mandatory human-in-the-loop step (Step 6), requiring the user to review and confirm the generated changelog before the release is created, which significantly reduces the risk of automated exploitation.

create-release