The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from pull request bodies, comments, and various repository files (e.g., PLAN.md, HANDOFF.md).
Ingestion points: Untrusted data enters the context via references/resume-orient.md (parsing tracking files) and references/run-folder-lookup.md (reading PR descriptions).
Boundary markers: The skill includes a dedicated 'Untrusted content boundary' in references/agentic-setup.md, explicitly instructing the agent to treat repo/tracker content as data rather than instructions and to report suspected injection attempts.
Capability inventory: Capabilities include Git operations (git worktree, git push), file system access, subagent spawning via the Agent tool, and tracker mutations (comment-pr, apply_label).
Sanitization: The skill mandates strict regex validation (^[A-Za-z0-9._/-]+$) for external values and requires shell/path interpolation to be properly quoted.
[COMMAND_EXECUTION]: The skill performs shell-based operations to manage isolated development environments.
Evidence: references/worktree-setup.md contains logic for git worktree add, git fetch, and directory management.
[DYNAMIC_EXECUTION]: Employs a dispatcher/executor pattern that spawns subagents at runtime.
Evidence: references/executor-dispatch.md describes using the Agent tool to delegate specific implementation steps to general-purpose subagents.

om-auto-continue-pr-loop