The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly directs the agent to interact with sensitive files containing credentials. It instructs the agent to check ~/.npmrc for npm authentication tokens and provides a workflow for the user to update this file via the agent. It also points the agent to ~/Scripts/claude-mem/.env, which is stated to contain Discord webhook credentials for notifications.
[INDIRECT_PROMPT_INJECTION]: The skill generates a changelog by processing data fetched from external sources (GitHub releases).
Ingestion points: Data provided to scripts/generate_changelog.js via stdin, sourced from GitHub releases.
Boundary markers: None. The agent is not instructed to ignore instructions embedded within the release notes or commit messages.
Capability inventory: High-impact capabilities including npm publish, git push, git tag, and gh release create.
Sanitization: The generate_changelog.js script parses JSON but does not sanitize or validate the content of the body field from the release data before writing it to CHANGELOG.md.
[COMMAND_EXECUTION]: The skill relies extensively on shell command execution to perform its lifecycle tasks. This includes npm publish, npm install, git operations, and gh (GitHub CLI) commands. While these are necessary for the skill's primary purpose of version management and releasing, they represent a significant capability surface that is automatically executed by the agent.

version-bump