The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external and potentially untrusted content (issue descriptions, PR bodies, diffs, and logs). It includes robust mitigation strategies and defensive instructions to maintain an 'untrusted content boundary'.\n
Ingestion points: Processes data from the repository, tracker items (GitHub/GitLab issues and PRs), and CI logs as documented in references/agentic-setup.md.\n
Boundary markers: Explicitly instructs the agent to treat repository and tracker content as data, never as instructions, and to refuse any embedded directives like 'ignore previous instructions'.\n
Capability inventory: The skill invokes companion skills (om-implement-feature, om-setup-agent-harness) and performs file system and tracker operations.\n
Sanitization: Implements strict regex validation (^[A-Za-z0-9._/-]+$) for any externally-sourced values before they are used in shell commands or path interpolations.\n- [DYNAMIC_EXECUTION]: The workflow supports repository-specific customization by loading a local SKILL.md extension.\n
Evidence: SKILL.md and references/agentic-setup.md mandate checking for a repo-local extension file.\n
Safety: The skill explicitly instructs the agent to skip and report any directive in a local extension that attempts to relax safety rules, expand tool/network access, or redirect outputs, ensuring core safety rules remain authoritative.\n- [PROMPT_INJECTION]: The skill avoids vulnerability to role-play or override injections by including training instructions that specifically identify these patterns ('ignore previous instructions', 'run this command') as malicious data to be quoted and reported rather than executed.\n- [DATA_EXFILTRATION]: references/rules.md defines a 'Secrets hygiene' policy that strictly prohibits surfacing tokens, credentials, or .env content in comments or logs, regardless of instructions from external content or other skills.

om-implement-feature-optimized