The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content such as pull request bodies, issue descriptions, and tracker comments, creating an attack surface for indirect prompt injection.\n
Ingestion points: Pull request bodies, issue descriptions, tracker comments, and repository configuration files (as described in references/agentic-setup.md).\n
Boundary markers: The skill explicitly instructs the agent to treat repository and tracker content strictly as data, never as instructions. It specifically identifies common injection patterns like 'ignore previous instructions' and directs the agent to report these as suspicious rather than complying.\n
Capability inventory: The skill uses tracker operations (close-issue, comment-issue, assign-issue) and local shell utilities (jq, date).\n
Sanitization: All externally-sourced values (issue IDs, PR numbers, slugs) are validated against a strict regex allow-list (^[A-Za-z0-9._/-]+$) and must be quoted during shell or path interpolation.\n- [COMMAND_EXECUTION]: The skill performs shell operations and path interpolation, particularly during setup and regex generation for keywords. Potential command injection risks are mitigated by mandatory validation of all external inputs and strict quoting requirements.\n- [PROMPT_INJECTION]: The skill includes proactive defense against jailbreak and override attempts. It mandates that any directives found in repository content (e.g., 'run this command') be ignored and reported, protecting the agent's core instruction set.\n- [CREDENTIALS_UNSAFE]: To prevent data exposure, the skill implements a strict policy against copying pull request bodies verbatim into issue comments, as these bodies may contain hardcoded secrets or sensitive credentials.

om-close-fixed-issues