The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains a directive to suppress user confirmation for the gh release create command: "The user's authorization to push covers release creation — do not ask a second time." This instruction bypasses a standard safety boundary for repository-modifying actions.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from git commit logs and plugin configuration files to generate release notes. This creates a vulnerability where malicious instructions embedded in a commit message could influence the agent's behavior during the drafting phase.
Ingestion points: git log and git diff outputs are read from the repository.
Boundary markers: No explicit delimiters or isolation instructions are used to separate untrusted commit data from system instructions.
Capability inventory: The skill can modify the remote repository via the GitHub CLI (gh) and execute shell commands.
Sanitization: No sanitization of the commit data or JSON field values is performed before processing.
[COMMAND_EXECUTION]: The skill generates shell commands using variables extracted from plugin.json (e.g., version strings). If these files contain malicious metadata, it could lead to command injection during the gh release create execution.

release