The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted external data that could contain malicious instructions designed to subvert the agent's behavior.
Ingestion points: The skill instructions in SKILL.md direct the agent to fetch data using git log and gh pr list. This data includes commit messages, Pull Request titles, and labels which are controlled by external contributors.
Boundary markers: Absent. There are no instructions to use delimiters or warnings to ignore embedded commands within the fetched data.
Capability inventory: The skill uses subprocess calls to execute git and gh CLI tools (specified in SKILL.md).
Sanitization: Absent. There is no mention of filtering, escaping, or validating the content of commit messages or PR titles before the agent processes them for categorization and summary.
[COMMAND_EXECUTION]: The skill uses the shell to execute git and gh (GitHub CLI) commands to retrieve repository history and metadata. While these are read-only operations and part of the intended functionality, they represent a capability that could be targeted if the input parameters (like version tags) are not properly handled by the agent.

release-notes