The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute system commands including git, gh, and Rscript. These commands are scoped to the intended purpose of managing R package releases and repository metadata.
[COMMAND_EXECUTION]: Shell operations involving user-controlled or file-based variables, such as package versions and checklist content, are performed using secure patterns. The skill instructions use double-quoting for arguments (e.g., "${NEW_VERSION}") and a quoted heredoc (<<'EOF') for the GitHub issue body, which prevents shell expansion and command injection.
[EXTERNAL_DOWNLOADS]: The workflow references the usethis R package, a standard tool for R package development. It provides instructions for the user to install the package from an official package registry (CRAN) if it is not already present on the system.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from local package files to generate release suggestions and checklist content.
Ingestion points: DESCRIPTION and NEWS.md files located in the R package root directory.
Boundary markers: The agent is instructed to present the suggested release type and the generated checklist to the user for explicit confirmation and manual customization using the AskUserQuestion tool before any external actions are taken.
Capability inventory: File reading via the Read tool and shell command execution via the Bash tool (specifically for Rscript, gh, and git).
Sanitization: Content read from files is used for template population and then passed to the gh tool via a secure stdin redirection to prevent interpretation as shell commands.

create-release-checklist