The Agent Skills Directory

[COMMAND_EXECUTION]: Interacts with the local environment and GitHub via shell commands using standard CLI tools including git, gh, npm, and pnpm to manage the repository state.
Evidence: Usage of commands like git fetch origin main next, gh pr list, and pnpm changeset throughout SKILL.md.
[REMOTE_CODE_EXECUTION]: Triggers package installation from the npm registry using pnpm install, which involves downloading and potentially executing external code from a well-known service.
Evidence: pnpm install is executed within a clean worktree during the sync process.
[DYNAMIC_EXECUTION]: Executes a repository-local Node.js script to perform complex release logic and metadata synchronization.
Evidence: node tooling/scripts/release-branch-prs.mjs sync-main-to-next in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub (Pull Request titles/bodies and workflow run statuses) and the npm registry, which serves as a potential vector for indirect prompt injection.
Ingestion points: gh pr list, gh run list, and npm view retrieve data from external sources into the agent context.
Capability inventory: The agent has permissions to execute git commands, push to branches, and trigger GitHub workflows.
Boundary markers: The skill includes instructions for the agent to review the generated Pull Requests (e.g., checking for specific labels and package versions), providing a manual verification step.
Sanitization: No explicit technical sanitization or escaping of external metadata is described in the logic.

release-lanes