The Agent Skills Directory

[PROMPT_INJECTION]: The skill ingests untrusted data from the repository's commit history to automate versioning decisions.
Ingestion points: The git log command in Step 2 retrieves commit messages from the project history.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore potentially malicious content within commit messages.
Capability inventory: The skill has the ability to create and push Git branches, open pull requests, and create GitHub releases via the gh tool.
Sanitization: No sanitization or filtering of commit message content is performed before processing.
[COMMAND_EXECUTION]: The skill executes local repository scripts including scripts/bump-version.js and scripts/ci-wait-merge.sh, as well as standard project commands like npm test and npm run build. While these are standard for release workflows, they involve executing code from the local environment.
[EXTERNAL_DOWNLOADS]: The use of npm commands implies potential interaction with the NPM registry for dependency management or build processes, which may lead to the execution of third-party code.

release