The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from pull requests (titles, bodies, and diffs) which could contain malicious instructions. The skill includes specific defensive logic to handle this attack surface.
Ingestion points: The skill fetches external data using tracker operations such as list-prs, get-pr, and get-pr-diff (detailed in references/pr-window.md).
Boundary markers: The skill defines an "Untrusted content boundary" in references/agentic-setup.md, explicitly instructing the agent to treat repo/tracker content as data, not instructions, and to report suspected injection attempts rather than complying.
Capability inventory: The skill uses shell utilities (jq, date, mktemp) and delegates PR creation to a companion skill om-auto-create-pr (described in SKILL.md and references/report-templates.md).
Sanitization: The skill mandates HTML-escaping for all tracker-sourced data in the HTML artifact (references/artifact-format.md) and requires redacting credential-shaped or customer-identifying strings from the report (references/rules.md).
[COMMAND_EXECUTION]: The skill uses local shell commands for utility purposes, such as parsing configuration with jq and calculating dates with date. These operations are limited to standard environment variables and use hardcoded logic or validated inputs (e.g., the SLUG validation regex ^[a-z0-9][a-z0-9-]*$ in references/pr-window.md).
[SAFE]: The skill follows security best practices by implementing a "Secrets hygiene" policy that forbids the inclusion of tokens, .env content, or raw credentials in any output (comments, logs, or reports), even if instructed by external data.

om-auto-qa-scenarios