The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool and Node.js scripts wrapping execSync to perform deployment tasks. These commands interpolate variables derived from the local environment, such as directory names (as skill names) and git tags. If the repository contains maliciously named directories or tags (e.g., using shell metacharacters like semicolons), it could result in arbitrary command execution when the agent or scripts process these strings.
[INDIRECT_PROMPT_INJECTION]: The deployment workflow requires the agent to read, analyze, and summarize untrusted data from the git repository, specifically commit messages and code diffs, to build changelogs. This presents a risk where malicious instructions embedded in the git history could influence the agent's behavior during the release process.
Ingestion points: Git log and git diff outputs processed in SKILL.md (Step 2b) and scripts/deploy-analyze.mjs.
Boundary markers: Absent. The instructions do not define clear delimiters or instruct the agent to ignore instructions embedded within the git data.
Capability inventory: The skill has access to the Bash tool, file system write permissions, and network capabilities via git push and the GitHub CLI (gh).
Sanitization: While version strings are validated with a regular expression, the textual content from git logs is not sanitized before being processed by the agent.
[SAFE]: The skill implements several security best practices, including a mandatory pre-flight validation script, a recommended dry-run mode that simulates actions without making changes, and the use of the AskUserQuestion tool to require human approval before performing irreversible or network-facing operations.

agent-skill-deploy