The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Markdown files (CHANGELOG.md, DEVELOPER_CHANGELOG.md) and repository manifests. This creates an attack surface where maliciously crafted entries could attempt to influence the agent's behavior during maintenance tasks.
Ingestion points: Repository history and files are read by scripts/query.ts, scripts/lib/changelog-parse.ts, and scripts/setup.ts to answer history questions or prepare release data.
Boundary markers: The skill implements structured parsing of Markdown using regular expressions to identify headings, bullets, and machine-readable comments (signatures and curation metadata), providing clear separation between data and instructions.
Capability inventory: The skill can write to the local file system, modify file permissions (chmod), and execute Git commands via its helper scripts.
Sanitization: Scripts perform deterministic parsing and validate input against strict JSON schemas, and file system operations include checks to prevent path traversal and symbolic link abuse.
[COMMAND_EXECUTION]: The skill utilizes the local git CLI to inspect repository state, commit history, and tags.
Evidence: Helper scripts (scripts/setup.ts, scripts/handoff.ts, scripts/query.ts) use spawnSync or execFile from the Bun/Node.js runtime to execute Git commands. These executions are performed using argument arrays rather than raw shell strings, preventing shell injection vulnerabilities. The operations are strictly limited to repository metadata inspection necessary for the skill's primary purpose.

simple-changelogs-skill-maintainer