The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill identifies and processes untrusted pull request data as part of its core review workflow.
Ingestion points: Pull request titles, bodies, and code diffs fetched in SKILL.md (Step 1) and processed via the om-auto-review-pr skill.
Boundary markers: The references/agentic-setup.md file defines a clear 'Untrusted content boundary,' instructing the agent to treat external content solely as data and ignore any embedded directives.
Capability inventory: The skill uses tracker tools to list and comment on PRs and delegates analysis to a companion skill. It does not perform arbitrary network requests or local file writes outside the repository scope.
Sanitization: The skill includes explicit instructions to redact credentials and tokens from model output and to validate external values before interpolation into shell commands.
[PROMPT_INJECTION]: The skill contains phrases that resemble prompt injection patterns.
Evidence: Phrases like 'ignore previous instructions' are listed in references/agentic-setup.md as examples of directives the agent must disregard when encountered in untrusted PR content.
[DATA_EXFILTRATION]: Strong controls are in place to prevent accidental data exposure.
Evidence: The references/rules.md file mandates 'Secrets hygiene,' prohibiting the disclosure of tokens or environment variables in any autonomous output.

om-review-prs