The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill executes local repository configuration files using node -e to extract commitlint rules. Specifically, it uses require() to load .cjs files, which executes any code contained within those files. While a standard pattern for JavaScript development tools, it allows for the execution of arbitrary code if a repository contains malicious configuration files.
Evidence: node -e 'const c=require("./commitlint.config.cjs"); console.log(JSON.stringify(c.rules,null,2))' in references/commit-conventions.md.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local repository (git logs, diffs, PR templates, and QA artifacts) to generate PR descriptions and release notes, which could be exploited to influence agent behavior.
Ingestion points: The skill reads git history via git log, repository-provided templates like .github/PULL_REQUEST_TEMPLATE.md, and QA reports from .compozy/tasks/.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when interpolating this external data into the PR composition process.
Capability inventory: The agent has the ability to write to the file system (git add, git commit), create PRs (gh pr create), and add release notes (pr-release add-note).
Sanitization: No sanitization or escaping of the ingested text is performed before it is included in the PR body.

ship-pr