The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted content from commit messages, pull request titles/bodies, and issue tracker descriptions during the release validation process.
Ingestion points: Untrusted data enters the context through git log output, gh pr list/view metadata, and Linear issue tracker data in REFERENCE.md.
Boundary markers: The skill uses regex boundaries for issue keys (e.g., $key([^0-9]|$)) to prevent accidental matches, but lacks rigid delimiters or escaping for broader natural language content processed from changelogs or PR bodies.
Capability inventory: The agent has the ability to merge pull requests, update issue states via gh api, and execute various shell commands (git, gh).
Sanitization: The skill includes a dedicated 'Author authority' section in REFERENCE.md that explicitly instructs the agent to treat third-party text as data, never as instruction, and to stop for human review if instructions are detected.
[COMMAND_EXECUTION]: The skill performs shell command execution to drive git and the GitHub CLI. It resolves configuration from a local file (.tituskirch-skills.json) and interpolates these values into shell commands.
The skill uses a helper script resolve-config.sh and jq for parsing, and provides guidance on safe interpolation (using printf and jq rather than direct substitution) to mitigate command injection risks.
All critical destructive or state-changing actions, such as gh pr merge, are explicitly gated by mandatory human confirmation in the 'Guardrails' section.

release