The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources like issue trackers and feature briefs, creating a surface for potential injection attacks.
Ingestion points: Issue metadata and comments retrieved via get-issue and search-prs (documented in SKILL.md and references/agentic-setup.md).
Boundary markers: Instructions in references/agentic-setup.md mandate treating repo/tracker content as data rather than instructions and ignoring any embedded directives.
Capability inventory: The skill can execute shell commands, create pull requests, post comments, and capture visual evidence via a browser provider.
Sanitization: External identifiers (issue IDs, slugs, branch names) are validated against the regex ^[A-Za-z0-9._/-]+$ before being used in shell interpolation.
[DYNAMIC_EXECUTION]: The skill executes installation commands defined by the target repository's configuration.
Evidence: references/worktree-setup.md instructs the agent to install dependencies using the repository's lockfile (e.g., npm install, cargo install).
Risk: This could lead to the execution of malicious code via repository-defined pre-install or post-install hooks.
[PROMPT_INJECTION]: The skill allows instructions to be extended by a file stored within the target repository.
Evidence: references/agentic-setup.md describes a preflight step to load and apply a repo-local SKILL.md as an extension.
Risk: A compromised repository could attempt to provide malicious instructions via this file, although the agent is explicitly directed to ignore directives that relax safety rules.
[COMMAND_EXECUTION]: The skill utilizes shell commands for environment setup and repository management.
Evidence: Git worktree management and branch creation are performed via shell scripts in references/worktree-setup.md.

om-auto-write-spec