The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill is designed to load and apply a repository-local extension located at .ai/skills/om-stabilize-ci/SKILL.md. While the instructions explicitly forbid this local extension from relaxing safety rules or expanding access, the mechanism itself allows repository-controlled content to inject logic into the agent's operation.
[COMMAND_EXECUTION]: The workflow executes shell commands defined within the repository's .ai/agentic.config.json file (specifically validation.commands). This enables the repository to dictate arbitrary commands that the agent will run in its worktree environment.
[PROMPT_INJECTION]: The skill processes untrusted external content, including CI logs, PR comments, and issue descriptions. It correctly identifies this as a risk and includes explicit defensive instructions to treat such content as data rather than commands. The deterministic detection of instruction-override patterns is a false positive in this case, as the phrases are used defensively to protect the agent.
[COMMAND_EXECUTION]: The skill performs shell operations like git worktree add, mkdir, and git push. While these are standard developer actions, they are performed on paths and branches partially derived from external PR/Branch data, although the skill includes quoting and validation requirements to mitigate injection risks.

om-stabilize-ci