The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to load and apply a repository-local version of the skill instructions if present. The instructions in references/agentic-setup.md state that "repo specifics win," which allows the repository being analyzed to override the agent's intended behavior and logic by providing its own version of the skill in the .ai/skills/ directory.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and aggregate untrusted data from the repository, including PR bodies, diffs, and issue descriptions. This creates a significant surface for indirect prompt injection attacks where malicious instructions embedded in the repository data could influence the agent's actions during the aggregation process.
Ingestion points: references/unit-queue.md lists PR numbers, titles, and author data as inputs; SKILL.md describes resolving windows into queues of units.
Boundary markers: references/agentic-setup.md includes explicit instructions to treat repository content as data and not instructions, specifically warning the agent to ignore directives like "ignore previous instructions."
Capability inventory: The skill invokes several companion tools (om-auto-sec-report-pr, om-auto-create-pr) and performs file writes to create aggregated reports and HTML artifacts.
Sanitization: The skill includes regex-based validation for identifiers (PR numbers, slugs) and a pre-publish gate that uses grep to identify potential secret leaks and withheld disclosure tokens before the report is finalized.
[COMMAND_EXECUTION]: The skill dynamically constructs and executes shell commands for sub-tasks using identifiers (PR numbers, branch names) sourced from the repository. While it includes validation rules (e.g., ^[A-Za-z0-9._/-]+$), the reliance on untrusted external values for command interpolation is a potential injection vector.
[DATA_EXFILTRATION]: The skill accesses repository configuration files and tracker metadata to generate its reports. While it implements a "disclosure policy" and automated redaction gates to prevent leaking sensitive findings or secrets into the final report, the mechanism to ship these reports as pull requests (securityReport.publish: "pr") represents a data exfiltration path if the redaction logic is bypassed.

om-auto-sec-report