The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from git history which could theoretically contain malicious instructions.
Ingestion points: Commit subjects and diffs via git log and git show, and merged Pull Request titles.
Boundary markers: Absent; the agent is instructed to read and summarize this data into user-facing entries.
Capability inventory: File system write access to CHANGELOG.md, execution of local git commands, and execution of the bundled scripts/audit_changelog.py script.
Sanitization: Absent; the agent relies on its internal reasoning to filter out non-user-facing changes like CI or tests.
Risk: This is a low-risk surface common to developer tools. An attacker could craft a commit message to influence the generated changelog text, but the skill lacks the capabilities (like network exfiltration or high-privilege execution) for this to escalate to a severe attack.
[COMMAND_EXECUTION]: The skill uses local commands to perform its tasks.
Evidence: The workflow executes git describe, git log, git grep, and python3 scripts/audit_changelog.py.
Assessment: These are standard operations for a changelog management tool. The subprocess.run call flagged in the test script (scripts/test_audit_changelog.py) is used exclusively to run the skill's own audit script against test cases, which is a benign and expected use of the module.

update-changelog