The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, potentially untrusted data from issue trackers and code repositories. It includes proactive mitigation strategies.
Ingestion points: Data is ingested through tracker operations (search-issues, get-issue) and by reading codebase files (SKILL.md Step 4).
Boundary markers: The skill defines an "Untrusted content boundary" in references/agentic-setup.md, explicitly instructing the agent to treat repository and tracker content as data, never instructions.
Capability inventory: The skill can create issues and comments, and trigger a spec-authoring PR via delegation. It is restricted from modifying repository source files directly.
Sanitization: The agent is instructed to refuse directives found in data, quote them as suspected injection in reports, and continue with its defined rules.
[SAFE]: The skill enforces "Secrets hygiene" (references/rules.md), ensuring that credentials, tokens, and .env content are redacted and never leaked into model outputs, logs, or tracker comments.
[SAFE]: The skill uses delegation to other locally installed companion skills (such as om-auto-write-spec and om-setup-agent-pipeline) from the same vendor rather than fetching or executing remote code from untrusted external sources.
[SAFE]: Static analysis hints regarding prompt injection were identified as false positives. The flagged phrases (e.g., "ignore previous instructions") are part of defensive security rules instructing the agent on how to detect and ignore malicious input, rather than being injection attempts themselves.

om-prepare-issue