The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from issue trackers, pull requests, and user-provided briefs with explicit security guardrails.
Ingestion points: Reads user briefs, image evidence, search results for issues and PRs, and various repository documents such as AGENTS.md and BACKWARD_COMPATIBILITY.md.
Boundary markers: Explicitly instructs the agent to treat repository and tracker content as data rather than instructions, and to ignore or report any embedded directives like 'ignore previous instructions'.
Capability inventory: Includes tool usage for creating and commenting on tracker items and uploading image evidence via official tracker operations.
Sanitization: External values such as IDs and slugs are validated against restricted regex patterns and quoted before use in shell commands or file paths.
[PROMPT_INJECTION]: Supports repository-local extensions that can override or extend base instructions.
Evidence: The workflow allows applying a repo-local extension file where 'repo specifics win' over the core skill instructions. While it includes a safety constraint stating that extensions cannot relax safety or quality rules, this mechanism represents a potential instruction override point if the repository content is compromised.
[SAFE]: Implements industry-standard security best practices for AI agents.
Secrets Hygiene: Shared rules strictly prohibit the output of tokens, credentials, or environment file content, requiring the redaction of sensitive strings before they appear in logs, comments, or reports.
Execution Guardrails: Tool usage and companion skill invocation are restricted to locally installed, vendor-vouched collections, and autonomous execution is limited to documented steps and committed configurations.

om-prepare-issue