[COMMAND_EXECUTION]: The skill uses standard command-line utilities (git and gh) to query repository history and metadata. This is a standard and expected behavior for a tool designed to generate changelogs from version control.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to the way it ingests and processes external, untrusted content.
Ingestion points: Data is retrieved from PR descriptions, issue bodies, and commit messages via gh pr list, gh issue list, and git log commands as defined in SKILL.md.
Boundary markers: The instructions do not define clear delimiters or "ignore previous instructions" guards when the agent processes the retrieved text.
Capability inventory: The agent has the capability to write to the local file system (CHANGELOG.md) based on the summarized data.
Sanitization: There is no evidence of sanitization, filtering, or validation of the text retrieved from the GitHub API or git history before it is interpreted by the model.

changelog