The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content from repository files and tracker items. It implements a strict security boundary as defined in the evidence chain:
Ingestion points: The skill reads .ai/trackers/*.md, .ai/browsers/*.md, and UPGRADE_NOTES.md to identify required synchronization changes.
Boundary markers: Explicit instructions in references/agentic-setup.md command the agent to treat repo and tracker content strictly as data, to ignore directives addressed to the agent (e.g., "ignore previous instructions"), and to report suspected injections.
Capability inventory: Capabilities are restricted to diffing, editing artifacts under the .ai/ directory, and executing a limited set of utility commands.
Sanitization: The skill requires regex validation (^[A-Za-z0-9._/-]+$) for all externally sourced identifiers before shell or path interpolation.
[EXTERNAL_DOWNLOADS]: The skill fetches UPGRADE_NOTES.md from the collection's source repository (e.g., GitHub) to retrieve official upgrade guidance. This is a routine operation to sync configuration with the vendor's documentation.
[COMMAND_EXECUTION]: The skill utilizes standard command-line tools such as jq to parse JSON configuration and grep to verify the presence of required operations in descriptors. These commands are executed locally on project-controlled files and are subject to input validation rules.

om-apply-upgrade-notes