The Agent Skills Directory

[PROMPT_INJECTION]: The static analysis flag for prompt injection in references/agentic-setup.md is a false positive. The referenced content consists of defensive instructions for the agent to ignore and report malicious directives encountered in data, which is a recommended security practice for autonomous agents.
[COMMAND_EXECUTION]: The skill uses shell commands to perform git operations (commit, push, status) and jq for parsing local configuration files. These actions are restricted to the local repository environment and are scoped to the skill's primary function of managing PRs.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from repository files and issue trackers, creating a potential attack surface. It mitigates this risk through: 1. Ingestion points: Data is read from repository files and tracker issues as described in Step 0 and Step 2 of the workflow. 2. Boundary markers: Explicit instructions in references/agentic-setup.md define an 'Untrusted content boundary' to prevent command execution from external data. 3. Capability inventory: The skill uses git and tracker API tools for PR creation and metadata updates. 4. Sanitization: It implements regex validation (^[A-Za-z0-9._/-]+$) for externally-sourced values before shell or path interpolation.
[SAFE]: The skill mandates strict secret hygiene, requiring that credentials and tokens be redacted and never surfaced in logs, comments, or reports. It also follows the principle of least privilege by limiting companion skill invocation to a locally installed collection and verifying that repo-local overrides do not relax safety rules.

om-open-pr