The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to influence the agent's behavior during the changelog update process.
Ingestion points: The skill ingests data from multiple untrusted sources including commits, diffs, merged pull requests, and issue references as specified in SKILL.md Step 2.
Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the repository content being summarized.
Capability inventory: The skill has the capability to write to files (the project changelog) and perform repository metadata lookups (resolving issue numbers and remote URLs).
Sanitization: While Step 5 of the workflow includes a verification check to ensure no "unsupported claims, local paths, or credentials" are introduced, it does not explicitly sanitize the text for potentially adversarial instructions embedded within the commit history or pull request bodies.

update-changelog