The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes untrusted codebase files to determine project architecture and conventions.
Ingestion points: Reads package manifests, routes, services, and models from the local codebase to detect the tech stack and architecture.
Boundary markers: The instructions lack explicit delimiters or 'ignore embedded instructions' warnings when processing these external files.
Capability inventory: The agent can perform significant operations including modifying source files, running database migrations, executing test suites, and calling external APIs.
Sanitization: While the skill mandates input validation and parameterized queries for the code it implements, it does not explicitly handle the sanitization of instructions ingested from the existing codebase.
[COMMAND_EXECUTION]: The skill is configured to execute platform and project-specific tools such as ripgrep (rg), npm, prisma, and various test runners. While these tools are necessary for the skill's primary function of backend development and verification, they represent a capability tier that could be abused if malicious instructions are successfully injected.

oma-backend