The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted external data sources which could contain malicious instructions designed to influence agent behavior.\n
Ingestion points: According to references/agentic-setup.md, the skill processes repository and tracker content, including issues, PR bodies, diffs, documentation, and CI logs.\n
Boundary markers: references/agentic-setup.md establishes an 'Untrusted content boundary' that explicitly instructs the agent to treat repo/tracker content as data only and to ignore any embedded directives like 'ignore previous instructions' or 'run this command'.\n
Capability inventory: The skill possesses the ability to invoke companion tools (om-implement-feature, om-fix), modify the local file system (staging features), and interact with issue trackers via labels and comments.\n
Sanitization: The instructions in references/agentic-setup.md mandate regex validation (^[A-Za-z0-9._/-]+$) for externally-sourced values and require shell/path interpolation to be properly quoted.\n- [DYNAMIC_EXECUTION]: The skill workflow involves loading and applying repository-specific instruction extensions at runtime.\n
Evidence: SKILL.md and references/agentic-setup.md instruct the agent to check for and apply a repo-local .ai/skills/om-implement-feature-multi-optimized/SKILL.md extension.\n
Mitigation: The preflight instructions specifically state that these local extensions cannot relax safety rules, expand tool/network access, or redirect outputs, providing a defensive layer against malicious local configurations.\n- [SAFE]: Heuristic detections of prompt injection are false positives. The phrases identified (e.g., 'ignore previous instructions' in references/agentic-setup.md) are used within the context of security rules designed to prevent the agent from obeying such commands when found in untrusted data.

om-implement-feature-multi-optimized