The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill retrieves NPM passwords and one-time passwords (OTP) from a 1Password account (remotiondev.1password.com) using the op CLI. It specifically instructs the agent to pipe the retrieved password into subsequent commands using echo "$PASSWORD" |, which can expose secrets in process lists or shell history depending on the environment.
[COMMAND_EXECUTION]: The skill performs several high-risk command executions, including terminating running processes with SIGKILL and executing local shell scripts (runlambda.sh) and TypeScript files (set-version.ts) within the repository.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection during the changelog generation phase. It fetches PR titles and author logins via gh pr view. If a PR title is maliciously crafted, it could inject formatting or instructions into the final markdown file (/tmp/release-<version>.md).
[EXTERNAL_DOWNLOADS]: The skill executes bun i, which downloads and installs dependencies from external package registries.
[DATA_EXFILTRATION]: The skill accesses a sensitive 1Password vault. Although the data is intended for use with NPM and GitHub, the capability to programmatically extract and handle credentials represents a significant data exposure surface if the agent is redirected or compromised.
[COMMAND_EXECUTION]: The skill modifies the system PATH variable to ensure specific Ruby versions are used, which can influence how subsequent binaries and scripts are resolved and executed.

release