The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to run repository-specific scripts such as generate_changelog.py, upload_image.py, and lint-rerun. It also performs complex repository analysis using pipelines involving git, rg (ripgrep), and xargs to identify experimental features and unstable types.
[CREDENTIALS_UNSAFE]: The skill instructs the agent to retrieve a GitHub authentication token by executing gh auth token in the shell and passing it into a curl header to access potentially private media attachments.
[EXTERNAL_DOWNLOADS]: The skill uses curl to fetch media attachments from GitHub domains (github.com/user-attachments/...) as part of the release workflow to migrate them to vendor-controlled storage.
[INDIRECT_PROMPT_INJECTION]: The skill processes multiple markdown files from docs/content/changelog/upcoming/ which are authored by various contributors. These files are merged into the final changelog and their content is processed during a "polishing" phase, creating an attack surface for embedded instructions.
Ingestion points: Markdown files in the docs/content/changelog/upcoming/ directory are read and merged (SKILL.md).
Boundary markers: None; the content is merged directly into section headers without delimiters or "ignore instructions" warnings.
Capability inventory: The skill is granted Bash, Read, Edit, and Write permissions, and executes curl and local repository scripts.
Sanitization: No sanitization or validation of the ingested markdown content is performed before processing or merging.
[COMMAND_INJECTION]: The skill resolves a target version from user-supplied $ARGUMENTS and interpolates it directly into shell commands (e.g., pixi run uvpy scripts/generate_changelog.py --version 0.x.y), which could lead to command injection if the input is not strictly validated by the agent platform.

assemble-changelog