The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by processing untrusted data from external sources (pull request/merge request titles and commit messages) controlled by contributors.
Ingestion points: The get-notes.sh script fetches data from GitHub, GitLab, or Gitea via platform CLI tools and uses git log to collect commit messages.
Boundary markers: No explicit delimiters or instructions are used to separate the untrusted content from the shell commands or to warn the agent about potential instructions inside the data.
Capability inventory: The aggregated notes are used in sensitive shell operations including gh/glab/tea release create and git commit.
Sanitization: The get-notes.sh script strips conventional commit prefixes (e.g., feat:) using sed, but it does not sanitize shell metacharacters or check for embedded instructions.
[COMMAND_EXECUTION]: The workflow dynamically constructs shell commands for release creation using variables populated from the untrusted data described above. If a contributor creates a PR with a title containing shell metacharacters (e.g., backticks or $(...)), these could be executed by the shell during the final release step. While the inclusion of a user preview and confirmation step (Step 8) provides a manual oversight mechanism, the underlying injection vulnerability exists.

new