The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions specifically designed to detect and ignore prompt injection attempts found in external data. In references/agentic-setup.md, the agent is instructed to treat repository and tracker content strictly as data and to report any directives that attempt to override system instructions (e.g., "ignore previous instructions"). This is a defensive mechanism, not a vulnerability.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from pull requests (titles, labels, bodies) which presents a potential attack surface.
Ingestion points: Pull request metadata and body content accessed via tracker operations in SKILL.md and references/agentic-setup.md.
Boundary markers: Present. The skill defines a dedicated "Untrusted content boundary" section in references/agentic-setup.md with explicit instructions to ignore embedded commands.
Capability inventory: Limited to read-only tracker operations (list-prs, get-pr-checks) and internal project setup (om-setup-agent-pipeline).
Sanitization: Present. The skill implements strict regex validation (^[A-Za-z0-9._/-]+$) for any externally-sourced values used in shell or path interpolation.
[COMMAND_EXECUTION]: The skill uses jq and vendor-specific CLI tools for configuration and pipeline setup. Risk is mitigated by the input validation and quoting requirements specified in the setup instructions.

om-merge-buddy