The Agent Skills Directory

[PROMPT_INJECTION]: The static analysis identified a prompt injection pattern in references/agentic-setup.md. However, this is a false positive. The skill contains defensive instructions telling the agent to treat phrases like "ignore previous instructions" as suspected prompt injection and to refuse compliance when encountered in repository or tracker content.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from pull request bodies, diffs, and comments, creating a potential surface for indirect prompt injection. This risk is mitigated through several documented best practices:
- Ingestion points: Untrusted data enters the agent context via tracker operations like get-pr, get-pr-files, and list-issue-comments (referenced in SKILL.md and references/diagnose.md).
- Boundary markers: references/agentic-setup.md defines a clear "Untrusted content boundary," explicitly instructing the agent to treat repository and tracker content as data, not instructions.
- Capability inventory: The skill has the capability to mutate tracker state (labels, comments, assignments) and execute local om-* sub-skills, but it does not perform arbitrary shell execution or direct internet access.
- Sanitization: The skill mandates validation of externally-sourced values such as issue IDs, PR numbers, and branch names against strict regex patterns (e.g., ^[A-Za-z0-9._/-]+$) before any shell or path interpolation, as noted in references/agentic-setup.md.
[CREDENTIALS_UNSAFE]: The skill follows strict secrets hygiene protocols. references/rules.md explicitly prohibits the inclusion of secrets, tokens, or environment file content in any model output (plans, comments, logs) and requires that credential-looking strings be redacted before being quoted.

om-pr-autopilot