The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from several sources including the {brief} argument, repository issues, pull request bodies, CI logs, and remote content fetched via the --skill-url parameter. This constitutes a broad attack surface for indirect prompt injection.
Ingestion points: The workflow ingest data via the brief argument, tracker operations (reading issues and PRs), and external skill URLs provided at runtime.
Boundary markers: The skill provides specific instructions in references/agentic-setup.md to treat external data strictly as data rather than instructions, specifically warning against following 'ignore previous instructions' or commands embedded in that data.
Capability inventory: The skill possesses extensive capabilities including file system modification (via worktrees), Git operations (commit/push), tracker management (PR creation/labeling), network access (fetching skill URLs), and the ability to spawn subagents.
Sanitization: The instructions mandate regex validation for identifiers like issue IDs and branch names (^[A-Za-z0-9._/-]+$) and require proper quoting of external values during shell or path interpolation.
[EXTERNAL_DOWNLOADS]: The skill is designed to fetch and process external documentation or configuration via the --skill-url repeatable argument.
Evidence: references/external-skill-urls.md outlines the procedure for fetching these URLs and extracting actionable guidance.
Context: The skill limits the influence of this content by explicitly stating it must not override internal safety rules, project configuration, or security gates.
[DYNAMIC_EXECUTION]: The workflow utilizes a dispatcher pattern that spawns general-purpose subagents to implement individual steps of an execution plan.
Evidence: references/executor-dispatch.md describes the sequential spawning of executors using the Agent tool, including logic for model tier selection and result verification.
Control: Subagents are restricted to their specific step, are forbidden from claiming PR locks or posting comments, and cannot spawn further nested subagents.
[COMMAND_EXECUTION]: The skill performs various shell operations to manage the development environment and lifecycle of the code changes.
Evidence: references/worktree-setup.md includes shell commands for creating and removing isolated Git worktrees and installing project dependencies based on detected lockfiles.

om-auto-create-pr-loop