The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from repository files, PR bodies, and issue comments, creating a potential attack surface for indirect prompt injection.
Ingestion points: PR body parsing (step 3), HANDOFF.md and PLAN.md parsing (step 5), and general repository file access (references/agentic-setup.md).
Boundary markers: The skill includes an "Untrusted content boundary" in references/agentic-setup.md that explicitly instructs the agent to treat external content as data, not instructions.
Capability inventory: Git operations, file system writes, subagent spawning, and execution of validation commands.
Sanitization: Instructions in references/agentic-setup.md mandate regex validation (^[A-Za-z0-9._/-]+$) for external identifiers and consistent quoting.
[COMMAND_EXECUTION]: The skill executes various shell commands to manage the worktree and run project-specific validations.
Evidence: Orchestrates git commands for worktree creation and lifecycle management (references/worktree-setup.md).
Evidence: Executes arbitrary shell commands defined in the validation.commands configuration field during the final gate process (references/final-gate.md).
[EXTERNAL_DOWNLOADS]: The workflow requires the installation of project dependencies in an isolated worktree.
Evidence: references/worktree-setup.md instructs the agent to install dependencies using package managers such as npm, pnpm, bun, or cargo based on the repository contents.
[DYNAMIC_EXECUTION]: The skill dynamically manages task execution through subagents and configuration overrides.
Evidence: The executor-dispatch pattern (references/executor-dispatch.md) spawns subagents via the Agent tool to implement individual steps.
Evidence: The skill loads and applies repo-local SKILL.md files as extensions to its core logic (references/agentic-setup.md).

om-auto-continue-pr-loop