The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses subprocess.run to execute shell commands for repository management. Files scripts/formal_release.py, scripts/release_skills.py, and scripts/install_workbuddy_experts.py invoke git, gh, npx, and python3 to automate pull request creation, tagging, and skill installation. These operations are triggered by user-initiated release commands and are directed at the repositories specified in the configuration.
[EXTERNAL_DOWNLOADS]: The skill triggers downloads of external packages and scripts during its execution. scripts/release_skills.py uses npx skills add to install or update agent skills from remote repositories. The documentation also recommends installing the skill via claude plugin marketplace or npx skills.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of scripts that may be retrieved from external sources. scripts/install_workbuddy_experts.py executes the official WorkBuddy registration script located at a specific path within the application bundle. It also invokes internal scripts such as soia-meta-sync-skills/scripts/sync_soia_skills.py.
[DATA_EXFILTRATION]: The skill performs network operations that involve sending local repository data to GitHub. This includes pushing code changes, creating tags, and publishing Release Notes via the gh release create command. These operations are limited to the target GitHub repository configured for the release.
[PROMPT_INJECTION]: The skill ingests untrusted data from git logs to generate user-facing content (Indirect Prompt Injection). Ingestion points: scripts/generate_release_notes.py reads commit subjects via git log. Boundary markers: None identified; the commit subjects are categorized and appended to the CHANGELOG.md and GitHub Release notes. Capability inventory: The generated notes are written to the local file system (CHANGELOG.md) and sent to GitHub via the gh API. Sanitization: Minimal; the script classifies commits based on conventional prefixes but does not filter for malicious instruction content within the commit messages.

soia-meta-skill-release