The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/analyze_commits.py executes git commands using subprocess.run. Although arguments are passed as a list to mitigate shell injection, the skill relies on executing system-level binaries.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes git commit messages (untrusted data). [1] Ingestion points: Commit data is ingested via scripts/analyze_commits.py using git log. [2] Boundary markers: There are no delimiters used to isolate commit text from agent instructions. [3] Capability inventory: The skill can execute commands (git) and modify the filesystem (CHANGELOG.md). [4] Sanitization: No filtering or escaping is applied to the content of commit descriptions.

changelog