The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted commit messages and source code diffs, creating an exposure to indirect prompt injection if a commit message contains malicious instructions designed to hijack the agent workflow.
Ingestion points: SKILL.md (Step 3a and Step 3b) executes git diff and git log to fetch modifications and commit logs directly into the agent's context.
Boundary markers: Absent. No delimiters or structural isolation are applied to separate the untrusted repository text from the core system prompt instructions.
Capability inventory: SKILL.md implements file modifications (editing CHANGELOG.md in Step 6) and repository operations (git push and gh pr create in Steps 7 and 8).
Sanitization: Absent. Commit logs are directly parsed and converted into user-facing release descriptions without escaping or safety filtering.

github-release