The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process untrusted data from agent session bundles and eval harness results. It mitigates injection risks by including explicit instructions to disregard any directives found within the artifacts (e.g., 'ignore previous instructions') and treat them solely as evidence to be judged. It also mandates that instructions within artifacts never override the skill's own rules.
[COMMAND_EXECUTION]: The workflow utilizes standard tools like jq and git for configuration parsing and repository setup. It explicitly prohibits the execution of any commands found within the untrusted artifacts or session transcripts.
[DYNAMIC_EXECUTION]: The skill supports repo-local overrides and extensions via specific file paths. It contains logic to ensure these extensions do not relax safety protocols, expand tool/network access, or redirect outputs.
[DATA_EXFILTRATION]: Comprehensive redaction rules are defined to prevent the exposure of secrets, credentials, environment variables, or private prompt bodies in the final judge report. The skill is documented as read-only with no network publication capabilities.
[PROMPT_INJECTION]: Static analysis flagged a potential prompt injection override in references/agentic-setup.md. Upon review, this is a false positive; the text is a defensive instruction explicitly telling the agent to detect and report 'ignore previous instructions' directives found in untrusted content, rather than an attempt to override the agent itself.

om-judge-agent-session