The Agent Skills Directory

[OBFUSCATION]: The file references/report-templates.md contains a zero-width space (U+200B) within a filename example (step-01-….png). While potentially a formatting artifact, zero-width characters are a common obfuscation technique used to hide content or modify commands invisibly.
[DYNAMIC_EXECUTION]: In references/boot-env.md, the skill performs dynamic execution by sourcing a file path into the shell environment (. "$CREDENTIALS_FILE"). This pattern allows code within the external file to be executed in the current process, creating a risk if the environment descriptor points to an untrusted file.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface as it ingests and processes untrusted data from PR bodies, diffs, and live browser snapshots (HTML/text). While references/agentic-setup.md includes robust defensive instructions to treat repo/tracker content as data rather than instructions, the risk of the model following embedded directives in processed data remains.
[COMMAND_EXECUTION]: The skill extensively uses shell commands to manage git worktrees, interact with browsers via CLI tools, and provision environments. These commands often interpolate variables derived from the repository and external configuration ($WORKTREE_DIR, $BASE_URL, $BROWSER_COMMAND), requiring strict validation which the skill partially addresses via regex checks.

om-auto-qa-pr