The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands to interact with package managers (e.g., cargo, go, npm, bundle) and a user-defined knowledge.resolver command. While argument values are validated and quoted, the command template itself is retrieved from the .ai/agentic.config.json configuration file, making it a sensitive configuration point.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest third-party content from installed dependencies, creating a surface for indirect injection.
Ingestion points: Reads dependency manifests (e.g., package.json), documentation (e.g., AGENTS.md), and source code files across multiple ecosystems in references/ecosystem-detection.md.
Boundary markers: references/agentic-setup.md provides explicit defensive instructions to treat repository and tracker content as data rather than instructions, and specifically mandates ignoring agent-addressed directives found in dependency files.
Capability inventory: Perform file reads, execute package manager queries, and run bounded searches via rg or grep.
Sanitization: Dependency names and search queries are validated against a restrictive regex (^[A-Za-z0-9@._/:+*-]*$) and passed as quoted arguments to shell commands.
[DYNAMIC_EXECUTION]: The knowledge.resolver feature in references/agentic-setup.md allows for the execution of a repository-provided command string. The skill treats this as "operator-vouched" configuration, relying on the repository's code review process as the trust mechanism for the execution of this dynamic command.
[PROMPT_INJECTION]: A static analysis flag was triggered regarding instructions to ignore previous directives. Review of references/agentic-setup.md confirms these are defensive instructions intended to protect the agent from malicious overrides in local extensions, rather than a malicious injection attempt.

om-framework-context