The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local git commands (git log, git tag) to retrieve project history. These commands are used for read-only purposes and do not incorporate user-controlled variables, minimizing command injection risks.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it processes content from potentially untrusted sources to generate the AGENT_CHANGELOG.md file.
Ingestion points: The skill reads data from git log (which can contain attacker-controlled commit messages), file content in .claude/plans/, CLAUDE.md, README.md, docs/, and code comments (e.g., TODO, FIXME, HACK).
Boundary markers: The instructions do not define strict delimiters or instructions for the agent to ignore potentially malicious directions embedded within the summarized content.
Capability inventory: The skill has the capability to read any file in the repository and write the summarized results to the project root.
Sanitization: There is no evidence of sanitization or filtering to prevent natural language instructions found in commits or docs from being promoted into the authoritative changelog.

agent-changelog