The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The generate_release_notes.sh script processes untrusted data from the repository's git commit history to generate markdown notes, which could be exploited if commit messages contain malicious instructions.
Ingestion points: Commit messages retrieved via git log in scripts/generate_release_notes.sh.
Boundary markers: The script does not use delimiters or warnings to separate commit data from the rest of the generated release notes.
Capability inventory: The skill can write files to the local system and use the gh CLI to create releases on GitHub, representing a chain from data ingestion to remote API operations.
Sanitization: No escaping or validation is performed on the commit messages before they are included in the output notes.
[COMMAND_EXECUTION]: The workflow generation script lacks validation on user-provided input used for file operations.
Evidence: In scripts/create_workflow.py, the name argument is used to construct a file path: workflow_file = workflow_dir / f"{name}.yml". Without validation, this allows for potential path traversal if an agent is tricked into using a name like ../../filename, enabling file writes outside the intended .github/workflows directory.

github-expert