The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill retrieves and handles sensitive credentials using the 1Password CLI (op).
Evidence: Use of op item get "Npmjs" --reveal to obtain plain-text passwords.
Evidence: Piping passwords into commands (echo "$PASSWORD" | npm token create) which may be logged in process history.
Evidence: Storing plain-text NPM tokens in temporary scratchpad files ($SP/npm_token).
[COMMAND_EXECUTION]: The skill executes a wide range of administrative shell commands.
Evidence: Use of kill -SIGKILL on turbo processes.
Evidence: Modification of the PATH environment variable to override system Ruby with rbenv shims.
Evidence: Complex shell loops for polling NPM registry status using while read and backgrounding (&).
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via external GitHub data.
Ingestion points: The agent reads PR titles and author names via gh pr view (SKILL.md).
Boundary markers: Human approval and manual editing of the changelog are required before final publication.
Capability inventory: The agent has high-privilege access to NPM publishing, Git tagging, and GitHub release creation.
Sanitization: No explicit filtering or escaping of PR titles is performed before inclusion in markdown files.
[DYNAMIC_EXECUTION]: The workflow relies on executing project-local scripts.
Evidence: Execution of bun publish.ts, set-version.ts, and runlambda.sh which are assumed to be safe as part of the repository infrastructure.

release