The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill includes an instruction to "ALWAYS commit EVERYTHING" and ensures "NOTHING should be left uncommitted or unpushed." This directive forces the agent to bypass standard safety checks and increases the risk of accidentally committing sensitive files like .env configurations, SSH keys, or other local secrets that may be present in the working directory or build artifacts.
[DATA_EXFILTRATION]: By mandating the use of git add -A followed by git push, the skill provides a mechanism to transmit all local files to a remote repository. In combination with the instruction to commit every file, this creates a significant risk of data exfiltration for any sensitive data stored within the repository's path.
[COMMAND_EXECUTION]: The workflow involves the execution of several shell commands, including npm run build, git commands, and the GitHub CLI (gh). It also executes a local JavaScript file, scripts/generate_changelog.js, to process release data.
[INDIRECT_PROMPT_INJECTION]: The skill fetches external release data via the GitHub API and incorporates it into the project documentation, creating a surface for injection.
Ingestion points: External data is fetched from the GitHub API and piped to the ./scripts/generate_changelog.js script in SKILL.md.
Boundary markers: There are no boundary markers or instructions telling the agent to treat the fetched release content as untrusted data.
Capability inventory: The skill has the capability to commit and push files to a remote repository and execute build scripts.
Sanitization: The scripts/generate_changelog.js script parses and re-outputs the release body text without any sanitization or filtering, allowing potentially malicious content from external release notes to be written into the CHANGELOG.md file and subsequently handled by the agent.

claude-code-plugin-release