The Agent Skills Directory

[PROMPT_INJECTION]: The instructions include 'You are in AUTONOMOUS MODE. Do NOT ask questions,' which explicitly directs the agent to bypass standard interactive safety loops and user confirmation steps.
[COMMAND_EXECUTION]: The skill executes multiple shell commands including 'git tag', 'git log', and 'git remote get-url' to extract repository data. While these are required for the skill's purpose, they interact with external state and user-supplied commit history.
[DATA_EXPOSURE]: The 'Self-Evolution Telemetry' phase attempts to access and write to the '~/.claude/projects/' directory. Accessing the user's home directory to store execution metadata is a form of background tracking that occurs outside the primary scope of generating a changelog.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git commit messages and PR descriptions which could contain malicious instructions designed to influence the agent's behavior during the generation phase.
Ingestion points: Git commit history retrieved via 'git log' and existing 'CHANGELOG.md' files.
Boundary markers: Absent; the skill does not use specific delimiters or instructions to prevent the agent from following directives embedded within commit messages.
Capability inventory: File system read/write, shell command execution, and telemetry logging to the home directory.
Sanitization: Absent; the skill parses and re-formats commit messages directly into the output document without filtering or escaping content.

changelog