The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides instructions for managing high-value credentials, including NPM passwords and 2FA one-time passwords, using the 1Password CLI (op). It generates short-lived NPM tokens and stores them in a local scratchpad file for the duration of the release. The skill explicitly cautions against printing these tokens in logs or output and includes mandatory steps for their revocation and deletion after use.
[COMMAND_EXECUTION]: The skill executes a wide range of shell commands and project-specific scripts (e.g., bun publish.ts, sh runlambda.sh, npm dist-tag) to manage the build and deployment lifecycle. It also performs environment modifications, such as adjusting the PATH variable to prioritize specific Ruby versions required by the build system.
[INDIRECT_PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection as it ingests untrusted data from external sources, specifically PR titles and documentation files via gh pr view and git diff. This data is used to automatically generate a changelog. This risk is mitigated by a required human review and approval step, where the user must verify and potentially edit the generated changelog before the release is finalized.

release