The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize data from repository history, specifically merged PR descriptions and commit messages, to generate changelogs and marketing drafts (detailed in references/shipped-changes.md). This creates a surface for indirect prompt injection if an attacker can influence PR metadata or commit logs with malicious instructions intended to manipulate the agent's output.
Ingestion points: Merged PR titles, descriptions, and commit logs accessed via git log commands.
Boundary markers: The skill lacks explicit delimiters or instructions for the agent to treat this specific external data as untrusted or to ignore embedded instructions within it.
Capability inventory: The skill utilizes command execution (reading git logs) and file reading to gather data, and generates multiple forms of content (emails, social posts, blog drafts).
Sanitization: A critical mitigation is present: the skill explicitly states that all drafts are staged for human review and that 'Nothing in this workflow publishes on its own.'
[COMMAND_EXECUTION]: The skill includes instructions to execute shell commands such as git log to extract repository information for the changelog generation process. These commands use static flags and do not interpolate user-controlled variables in a way that suggests command injection risks.

launch