The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data including client transcripts, requirement documents, and repository metadata (PR bodies, issue descriptions, and titles).
Ingestion points: External materials are read from the {input} directory during Phase 1, and tracker data is ingested during Phase 2 via operations like list-prs and get-pr.
Boundary markers: The skill implements a robust "Untrusted content boundary" defined in references/agentic-setup.md. It explicitly instructs the agent to treat repo, tracker, and client-document content as data, not instructions, and to report suspected injection attempts.
Capability inventory: The skill has the capability to write to the local filesystem (under .ai/gap-analysis/ and .ai/tmp/), perform git operations (clone, fetch, fast-forward), and execute local shell scripts for verification.
Sanitization: The skill uses regex validation (e.g., ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$) for externally sourced values such as repository names, branch names, and project slugs before they are used in shell or path interpolation.
[COMMAND_EXECUTION]: The skill executes a suite of custom bash scripts located in its bin/ directory to perform deterministic validation of the analysis results.
Evidence: The workflow involves running bin/gap-checklist-gate, bin/gap-orientation-preflight, bin/gap-validate-finding, bin/gap-pipeline-crosscheck, and bin/gap-depth-check.
Security Controls: These scripts are designed with "fail-closed" logic and include protections against command injection. For example, bin/gap-validate-finding checks that grounding queries do not start with a hyphen to prevent flag injection and uses -- delimiters for search tools like rg and git grep.

om-gap-analysis