The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and prioritize project-level instructions from files such as AGENTS.md, CLAUDE.md, and .cursorrules. This creates a surface where an attacker contributing to a repository could influence agent behavior by providing malicious project-level rules.
Ingestion points: The skill reads configuration and rules from repository files: AGENTS.md, CLAUDE.md, .cursorrules, .omp/settings.json, and artifacts.provider settings.
Boundary markers: The instructions explicitly tell the agent to "Follow this file [AGENTS.md] first when it conflicts with generic agent defaults," granting external data high precedence over the agent's internal logic.
Capability inventory: The skill can dispatch subagents (via Task, @subagent, and other primitives), execute GitHub CLI commands (gh), and invoke MCP tools for task management systems like Linear and Plane.
Sanitization: There is no evidence of sanitization, validation, or instruction-filtering applied to the ingested project files.
[COMMAND_EXECUTION]: The skill adapter for the OMP (Oh My Pi) host invokes a project-local tool called woostack_rename_session. This tool is defined within the project's own .omp/extensions directory. While this allows for local code execution, it appears to be a documented feature for session management rather than a malicious backdoor.

using-woostack