The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements a structured 'Untrusted content boundary' in references/agentic-setup.md. It explicitly instructs the agent to treat all repository and tracker content (issues, PR bodies, diffs) as data rather than instructions. It specifically identifies common injection patterns like 'ignore previous instructions' and directs the agent to report them as suspected attacks rather than complying. While a static detector flagged a potential override, the context shows this is a protective boundary, not a malicious injection.
[COMMAND_EXECUTION]: Shell command execution is limited to resolving PR/Issue numbers and repository slugs. The skill requires validation of these externally-sourced values using strict regex patterns (^[A-Za-z0-9._/-]+$) before any shell or path interpolation, effectively mitigating command injection risks.
[DATA_EXFILTRATION]: The skill contains explicit rules against data exfiltration in its agentic-setup.md file, refusing any instructions that would touch state outside the repository, its containers, or its tracker. It also maintains a 'Secrets hygiene' policy in references/rules.md that forbids pasting credentials or .env content into public logs or comments.
[SAFE]: The skill operates within the expected scope of PR management (GitHub/GitLab/etc. trackers). It utilizes repo-local configurations and standard tracker operations (get-pr, merge-pr, etc.) to enforce human-defined merge gates. All external interactions are focused on the vendor's own tracker infrastructure.

om-approve-merge-pr