The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests untrusted data from task briefs and external URLs provided via the --skill-url argument.
Ingestion points: Task brief, spec documents, and external reference pages fetched at runtime as described in SKILL.md and references/external-skill-urls.md.
Boundary markers: The instructions in references/agentic-setup.md and references/external-skill-urls.md explicitly mandate treating external content as data rather than instructions, and require reporting suspected injection attempts.
Capability inventory: The skill can execute git commands, validation scripts (defined in local configuration), and perform tracker mutations (PR/issue updates).
Sanitization: The skill implements strict validation for shell and path interpolation, restricting characters to a safe set (^[A-Za-z0-9._/-]+$) and ensuring values are quoted, as documented in references/agentic-setup.md.
[COMMAND_EXECUTION]: The skill performs shell operations primarily for repository management and testing.
Evidence: references/worktree-setup.md executes git commands (git worktree add, git checkout) to create isolated environments. SKILL.md (Step 8) executes validation.commands which are pre-configured in the repository's .ai/agentic.config.json.
[EXTERNAL_DOWNLOADS]: The skill fetches external content for reference purposes.
Evidence: The --skill-url parameter allows the operator to provide external context. references/external-skill-urls.md establishes clear boundaries: only operator-provided URLs are fetched (no transitive fetching), and instructions from these sources to bypass security checks, skip tests, or exfiltrate credentials must be ignored.

om-auto-create-pr