The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the execution of 'eject recipes' provided by dependencies. This capability is heavily mitigated by multiple layers of security:
A mandatory <HARD-GATE> requires explicit user approval of the exact command and landing paths before execution.
The Command safety check (in references/recipe-contract.md) enforces strict parameter sanitization using an allow-list regex (^[A-Za-z0-9._/@-]+$) and ensures all arguments are quoted.
The skill explicitly refuses to execute commands that require network access, involve shell piping of remote content, or request privilege escalation (e.g., sudo).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata from third-party dependencies (recipes, guides, and AGENTS.md files). This surface is managed through a documented 'Untrusted content boundary':
Ingestion points: External data is read via knowledge.sources and the Task Router (referenced in references/recipe-contract.md and references/agentic-setup.md).
Boundary markers: The skill treats dependency content as data, not instructions, and explicitly uses a <HARD-GATE> in SKILL.md to prevent autonomous action.
Capability inventory: The agent can read files, write to repository paths, and execute shell commands (all scoped and user-approved).
Sanitization: All external values interpolated into commands are validated against a restricted regex and forbidden from accessing credential stores or .env files.
[PROMPT_INJECTION]: A static detector identified the phrase 'ignore previous instructions' in references/agentic-setup.md. Analysis confirms this is a defensive security instruction that tells the agent to disregard and report such directives if they are encountered in untrusted repository data, rather than being a malicious injection itself.

om-eject-and-customize