The Agent Skills Directory

[SAFE]: The skill implements a robust human-in-the-loop security model. All public-facing actions, such as posting comments to feedback tools or changing issue statuses, require explicit operator approval and are restricted to occurring only after the associated release is verified as live.
[PROMPT_INJECTION]: The skill has a surface area for indirect prompt injection as it ingests GitHub issue bodies and release notes containing user-authored text.
Ingestion points: Untrusted data enters via scripts/trace.mjs (release notes and issue bodies) and is processed in scripts/lib/ceremony.mjs.
Boundary markers: SKILL.md defines an explicit 'Safety Boundary' that instructs the agent to treat feedback data as opaque and never as instructions.
Capability inventory: The skill can draft changelogs, post comments, and update statuses via the provider adapter.
Sanitization: The skill uses a deterministic script (scripts/trace.mjs) to identify resolved items based on strict regex patterns, ensuring the execution flow (which items to modify) cannot be influenced by input text. All final content is reviewed by a human before being applied.
[COMMAND_EXECUTION]: The skill invokes the GitHub CLI (gh) to view releases and issues, and executes its own bundled Node.js scripts for data processing. These operations are limited to retrieving information from the working repository and do not involve shell injection vulnerabilities.
[SAFE]: The architecture demonstrates security maturity by including automated test suites (scripts/lib/ceremony.test.mjs) that specifically verify that malicious strings in feedback items do not trigger unauthorized adapter calls.

write-release-changelog