The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources including GitHub issue titles, bodies, and comments, as well as repository code and documentation.
Ingestion points: Found in SKILL.md workflow steps 1, 2, and 3 which read issue and PR data; and references/agentic-setup.md which describes reading repository and tracker content.
Boundary markers: The skill explicitly instructs the agent to treat repo/tracker content as data, never instructions, and to report suspected injections.
Capability inventory: The agent has access to git (read-only) and tracker operations like get-issue and search-prs.
Sanitization: Instructions in references/agentic-setup.md command the agent not to comply with embedded directives and to quote them in reports instead.
[COMMAND_EXECUTION]: The skill uses shell commands for repository inspection and configuration handling.
Evidence: SKILL.md uses git log and git fetch; references/agentic-setup.md includes a bash snippet using jq to parse .ai/agentic.config.json.
Mitigations: Instructions in references/agentic-setup.md require validation of every externally-sourced value against a strict regex (^[A-Za-z0-9._/-]+$) before shell interpolation.
[EXTERNAL_DOWNLOADS]: The skill fetches metadata and content from issue trackers and remote git repositories.
Evidence: Uses get-issue, search-prs, and git fetch to retrieve information from GitHub or other configured trackers.
Context: These operations are central to the skill's purpose and target well-known developer services.

om-verify-in-repo