The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documentation (SKILL.md) provides command examples that instruct the agent to execute local helper scripts (.ai/skills/update-changelog/scripts/update-changelog.ps1 and update-changelog.sh) with bypassed execution policies to perform changelog generation.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves parsing git logs (git log), which include commit messages and author names often provided by external contributors. This represents an attack surface for indirect prompt injection where malicious instructions embedded in a commit message could influence the agent during the documentation update process.
Ingestion points: Commit subjects and author metadata are ingested from the local repository's git history in both the PowerShell and Bash/Python scripts.
Boundary markers: The scripts structure output using standard Markdown headers (e.g., ### Features, ### Fixes), but there are no specific instructions or delimiters used to ensure the agent disregards instructional content within the commit descriptions.
Capability inventory: The skill includes functions to read project metadata (Directory.Build.props) and write to the changelog (docs/CHANGELOG.md).
Sanitization: The scripts do not perform sanitization or filtering of commit subjects to remove potential prompt injection payloads before the agent processes them.
[DYNAMIC_EXECUTION]: The scripts/update-changelog.sh file uses a heredoc to dynamically pass a Python script to the interpreter for execution. While the Python code itself is static within the shell script, this pattern involves runtime code injection and execution.

update-changelog