The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from project files such as CHANGELOG.md and package.json to automate release notes and version updates, which represents a potential injection surface.
Ingestion points: Reads local project files including CHANGELOG.md and package.json (found in SKILL.md and scripts/version_control.py).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands were found in the ingestion logic.
Capability inventory: The skill has capabilities to write files (registry.json, CHANGELOG.md), search code via grep_search, and execute build commands (npm run build).
Sanitization: There is no evidence of sanitization or validation for the content read from the project files before it is processed or used in shell commands.
[COMMAND_EXECUTION]: The PURGE protocol in SKILL.md utilizes npm run build to verify system state after code removal. This is a standard project maintenance operation but involves shell command execution.
[SAFE]: The Python script scripts/version_control.py is restricted to local file manipulation within the skill's own directory (e.g., .agent/skills/registry.json). It performs semantic versioning logic without network requests or access to sensitive user credentials.

ecosystem-managing