The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from git logs and API responses to generate release notes, which could contain malicious instructions.
Ingestion points: The agent is instructed to read content from git log and gh api comparison results in SKILL.md.
Boundary markers: The instructions lack explicit delimiters or safety markers to isolate the untrusted log data from the agent's instructions.
Capability inventory: The skill utilizes gh release create and executes various shell commands in SKILL.md.
Sanitization: The prompt instructs the agent to only include facts supported by the diff and to not invent information.
[DYNAMIC_EXECUTION]: The skill executes code directly from local project files to determine versioning.
Evidence: SKILL.md directs the agent to run node -p "require('./package.json').version", which loads and executes the local package.json file.
[COMMAND_EXECUTION]: The skill performs multiple operations using external CLI tools without human-in-the-loop validation.
Evidence: The workflow uses git, gh, node, and cargo commands to manage releases.
Concern: The instruction to proceed "without separate confirmations" increases the risk that an injected prompt or a malicious local file could trigger unauthorized actions.

github-release