The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources which could contain malicious instructions designed to alter the agent's output or influence its actions.
Ingestion points: The skill reads data from Git commit messages (git log), merged pull request titles and bodies (gh pr list), and changeset markdown files (.changeset/*.md) in Step 2 and Step 3.
Boundary markers: Absent. The instructions do not define clear delimiters or provide the agent with "ignore embedded instructions" warnings when processing the raw git and PR data.
Capability inventory: The skill has the capability to write files to the local filesystem (within the releases/ directory) and perform network operations via API calls to upsert "Cases" (POST /api/companies/:companyId/cases and PUT /api/cases/:releaseCaseId/documents/body).
Sanitization: The skill provides logic to exclude specific bot accounts and a list of excluded usernames, and explicitly forbids exposing email addresses, but lacks sanitization for potential prompt injection content within the commit or PR text.
[COMMAND_EXECUTION]: The skill relies on the execution of multiple shell commands and local scripts to gather data and perform its release tasks.
Execution patterns: The skill uses git, npm view, and gh CLI tools. It also executes project-specific local scripts including ./scripts/draft-stable-notes.sh and ./scripts/release.sh. These operations are consistent with the primary purpose of a release management skill.

release-changelog