The Agent Skills Directory

[PROMPT_INJECTION]: A static analysis flag was raised for text in 'references/agentic-setup.md' regarding overriding instructions. This is a false positive; the text is a defensive instruction advising the agent to ignore and report prompt injection attempts found in repository data.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which presents an indirect injection surface. Ingestion points: 'AGENTS.md', '.ai/help/*.md', and tracker content (PR/Issue bodies) as defined in 'SKILL.md' and 'references/routing-sources.md'. Boundary markers: The 'references/agentic-setup.md' file defines an 'Untrusted content boundary' requiring the agent to ignore embedded directives and quote suspected injections. Capability inventory: Commands include 'git', 'ls', and 'awk' for read-only discovery, plus read-only tracker access (current-user, list-prs). Sanitization: All interpolated values are validated against allow-list regular expressions (e.g., ^[A-Za-z0-9._/-]+$).
[COMMAND_EXECUTION]: The skill executes local read-only commands (git, ls, awk) to discover installed skills and repository state. It prevents command injection by validating configuration keys against restrictive regular expressions before use in shell contexts.

om-help