The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted content from the repository and tracker, which creates an attack surface for indirect prompt injection.
Ingestion points: The agent reads data from repository files, tracker issues, pull request bodies, and CI logs (documented in references/agentic-setup.md).
Boundary markers: The skill includes an explicit "Untrusted content boundary" instruction, telling the agent that repository and tracker content is data, not instructions, and to report suspected injection attempts rather than complying with them.
Capability inventory: The skill has the capability to write to the filesystem, execute git commands, spawn subagents via the Agent tool, and modify tracker items (labels, comments, and PR status).
Sanitization: The skill mandates the redaction of secrets, tokens, and credentials from all plans, logs, and comments. It also requires validation of externally-sourced values before shell or path interpolation.
[EXTERNAL_DOWNLOADS]: The skill allows fetching content from arbitrary external URLs provided by the user via command-line arguments.
Evidence: The --skill-url parameter triggers fetching of external content to be used during planning and execution (SKILL.md and references/external-skill-urls.md).
Risk Mitigation: The skill explicitly states that external content is reference material only and MUST NOT override project rules, safety guidelines, or CI gates.
[COMMAND_EXECUTION]: The workflow involves automated shell-based operations to manage isolated worktrees and perform development tasks.
Evidence: The skill executes bash commands for worktree creation, dependency installation, and git operations (references/worktree-setup.md).
Risk Mitigation: All work is conducted in isolated worktrees (outside the primary directory) and cleanup procedures are registered via traps to ensure temporary environments are removed even on failure.

om-auto-create-pr-loop