The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the repository (READMEs, package scripts, CI workflows) to discover how to run the project.
Ingestion points: Discovery phase in references/phase-2-generate.md (steps 2.1 and 2.2).
Boundary markers: The skill includes defensive instructions in references/agentic-setup.md and references/rules.md to treat repository content as data and ignore embedded directives addressed to the agent.
Capability inventory: The skill can write and execute shell scripts, use Docker, and invoke external browser-provisioning skills.
Sanitization: Instructions in references/agentic-setup.md require validation of external values via regex (^[A-Za-z0-9._/-]+$) and quoting before shell interpolation.
[COMMAND_EXECUTION]: The skill generates and executes entrypoint shell scripts (.sh or .ps1) to manage test environments. On Windows, it uses powershell -ExecutionPolicy Bypass to run these generated scripts, which bypasses local execution restrictions.
[DYNAMIC_EXECUTION]: Entrypoint scripts are generated at runtime based on the detected project stack. The generated scripts utilize eval for environment variable fingerprinting within the build cache mechanism.
[REMOTE_CODE_EXECUTION]: During the discovery process, the skill identifies and executes repository-native commands (such as npm install, docker-compose up, or custom build scripts). If a repository is malicious, these commands represent an execution vector.
[EXTERNAL_DOWNLOADS]: The skill may trigger downloads of browser engines or providers by calling the om-setup-agent-pipeline companion skill. It also uses utilities like curl and wget for health checks during environment provisioning.

om-prepare-test-env