The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains logic to handle potential prompt injection in the data it processes (PR descriptions, UI text). It instructs the agent to treat repo and on-screen content as data, never as instructions, and to report directives addressed to the agent (e.g., 'ignore previous instructions') rather than complying with them. This is a defensive security control, not a threat.- [DATA_EXPOSURE]: The skill includes a 'Secrets hygiene' section and 'Security boundaries' that explicitly prohibit the exfiltration of credentials, tokens, or .env content. It requires redacting credential-looking strings before they appear in reports or logs.- [COMMAND_EXECUTION]: The skill executes repository-sourced commands for building and running the app for review. These are limited to the documented workflow and repository scope. The instructions explicitly forbid commands that exfiltrate data or touch state outside the repository containers.- [INDIRECT_PROMPT_INJECTION]: The skill has a significant ingestion surface (PR diffs, tracker comments, and web content). However, it mitigates this by implementing a clear 'Untrusted content boundary' in references/agentic-setup.md, which defines all external content as data and provides explicit instructions to ignore and report embedded directives.- [EXTERNAL_DOWNLOADS]: The skill uses repo-local overrides and companion skills from a locally installed collection. It explicitly states that nothing new is fetched or installed at runtime.

om-ux-review-pr