The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to load and apply a repository-local override file at .ai/skills/om-pre-implement-spec/SKILL.md if present. This allows the codebase being audited to provide additional instructions to the agent, which is a potential injection vector. The skill attempts to mitigate this by stating that "safety rules still win" and instructions to "never relax safety or quality rules".- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves reading untrusted content from specifications, issue trackers, and pull requests. This presents an indirect prompt injection surface. The skill provides extensive mitigation instructions in references/agentic-setup.md, defining an "untrusted content boundary" that instructs the agent to treat such content as data, ignore embedded directives, and report suspected injection attempts.
Ingestion points: Spec files, tracker issue bodies, PR descriptions, and discussion comments (mentioned in SKILL.md and references/spec-resolution.md).
Boundary markers: Explicit instructions in references/agentic-setup.md to ignore directives like "ignore previous instructions".
Capability inventory: File system read, codebase search (ripgrep/search), tracker read operations, and limited shell command execution.
Sanitization: Path safety checks using regex (^[A-Za-z0-9._/-]+$) and exclusion of .. segments.- [COMMAND_EXECUTION]: The skill allows running repository-sourced commands if they are within scope for "building, testing, running, or reviewing this project". This is a potential risk if a malicious repository contains scripts that execute unintended actions, though it is scoped to project-related tasks and prohibits data exfiltration.

om-pre-implement-spec