The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains text commonly associated with prompt injection, such as "ignore previous instructions." However, these are strictly defensive instructions located in references/agentic-setup.md that command the agent to identify and ignore injection attempts within untrusted repository data, rather than attempting to bypass safety filters.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill processes potentially untrusted data including issue descriptions, pull request bodies, and repository files via its diagnosis and review workflows.
Boundary markers: The harness uses structured review packets and XML-like tags (e.g., <review_packet>, <review_subject>) to separate untrusted data from instructions.
Capability inventory: The skill can execute local CLI commands (via harness.mjs), write to the local filesystem (staging changes), and communicate with external LLM APIs for reviews.
Sanitization: There are explicit instructions for the agent to validate externally-sourced values and refuse directives found within data that attempt to trigger unauthorized operations like data exfiltration or credential access.
[COMMAND_EXECUTION]: The skill executes configured CLI tools for model interaction and repository management. It follows best practices by using child_process.spawn with shell: false, preventing shell injection vulnerabilities. Execution is further restricted by an environment variable allowlist and isolation checks.
[DATA_EXPOSURE]: The skill manages API credentials for LLM providers. It correctly separates these secrets, passing them only to authorized reviewer processes while explicitly scrubbing them from the environment of implementation worker processes.

om-harness