The Agent Skills Directory

[SAFE]: The skill describes a standard release management workflow using Changesets. Its instructions focus on maintaining semantic versioning, changelogs, and CI/CD integration.
[CREDENTIALS_UNSAFE]: The skill follows security best practices by explicitly instructing that publishing credentials should be kept in CI secrets and never placed in changesets, repository configurations, or commits. It further recommends using short-lived OIDC-backed credentials (Trusted Publishing) over long-lived tokens.
[COMMAND_EXECUTION]: The commands referenced (e.g., changeset status, gh attestation verify) are standard, well-known tools used for release validation and supply-chain security. No suspicious or unauthorized command execution patterns were detected.
[INDIRECT_PROMPT_INJECTION]: The skill involves reading local configuration files such as .changeset/config.json and package metadata. However, it does not process untrusted external data in a way that would lead to prompt injection; the data is used strictly for determining version increments and release notes within a controlled workflow.

changesets-release