The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is configured to load and prioritize instructions found within the untrusted repository being processed, creating a vulnerability surface.
Ingestion points: The skill loads a repository-local skill extension (.ai/skills/om-spec-writing/SKILL.md) and treats project-specific instruction files (e.g., AGENTS.md, CLAUDE.md) as "architectural law". It also processes product briefs and research reports.
Boundary markers: The skill includes explicit instructions to ignore directives in data that attempt to override system instructions (e.g., "ignore previous instructions") and forbids complying with directives that relax safety or quality rules.
Capability inventory: The skill performs extensive file system reads, writes specification files to the disk, and interacts with other automation skills like om-auto-create-pr.
Sanitization: The skill contains instructions to validate externally-sourced values like IDs and branch names against a whitelist regex (^[A-Za-z0-9._/-]+$) and ensures they are quoted during interpolation.
[COMMAND_EXECUTION]: The skill resolves file paths and directory locations (e.g., SPECS_DIR) based on potentially untrusted repository configuration files.
Evidence: In references/agentic-setup.md, the skill resolves its working directory from .ai/agentic.config.json.
Risk: Manipulation of these configuration files could lead the agent to perform file operations in unintended directories, though this is mitigated by instructions to validate paths and refuse state changes outside the repository boundary.

om-spec-writing