The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves reading and analyzing untrusted data from repository files, PR bodies, and issue trackers, which could contain malicious instructions aimed at overriding agent behavior.
Ingestion points: As defined in references/agentic-setup.md, the skill ingests PR bodies, diffs, docs, and tracker metadata.
Boundary markers: The skill contains explicit defensive instructions in the "Untrusted content boundary" section of references/agentic-setup.md to identify and ignore directives like "ignore previous instructions" or "run this command" found in data.
Capability inventory: The skill has the capability to execute shell commands via the validation.commands gate and read/write files within the repository scope.
Sanitization: The agent is instructed to validate all externally-sourced values (like PR numbers and slugs) against a strict alphanumeric regex (^[A-Za-z0-9._/-]+$) before interpolation into shell commands or file paths.
[COMMAND_EXECUTION]: The skill executes arbitrary shell commands defined in the .ai/agentic.config.json file as part of its mandatory validation gate.
Evidence: The "Validation Gate" section in SKILL.md requires running commands in the validation.commands list to mirror CI processes. This is the primary purpose of the skill, but it constitutes a capability to run scripts defined in the repository metadata.

om-code-review