The Agent Skills Directory

[PROMPT_INJECTION]: The skill allows for repository-specific extensions via a local file at .ai/skills/om-pipeline-retro/SKILL.md. Although this is a configuration surface that allows local overrides, the instructions include a strict safety guardrail: the extension is explicitly forbidden from relaxing safety rules, expanding tool/network access, or redirecting outputs, and the agent is instructed to report any such attempts as suspected injection.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from external sources such as pull request bodies, reviews, and conversation comments.
Ingestion points: Data is retrieved from the tracker using list-prs and get-pr operations in SKILL.md (Steps 1 and 2).
Boundary markers: The skill provides a dedicated 'Untrusted content boundary' in references/agentic-setup.md instructing the agent to treat all external content as data, ignore embedded directives, and quote suspicious instructions in the report.
Capability inventory: The skill utilizes read-only tracker operations and executes a local shell script references/classify-runs.sh (Step 4).
Sanitization: Untrusted content is passed to the classification script via JSON on stdin to avoid shell command interpolation. The classify-runs.sh script itself uses jq to strip quoted lines and fenced code blocks from the text before performing classification logic.
[COMMAND_EXECUTION]: The skill executes a bundled shell script, references/classify-runs.sh, to classify the gathered JSON data. This is a local, deterministic script provided as part of the skill. The instructions include a fallback mechanism to apply the classification rules inline if the execution environment restricts shell commands, ensuring consistent behavior.

om-pipeline-retro