The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for external CLI advisors (e.g., Claude Code, Codex, OpenCode) and its own telemetry tool (omh runtime). These commands interpolate user-provided questions into shell strings (e.g., claude -p "<question>"), which presents a risk of command injection if the underlying agent platform does not sanitize the input.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources including user questions, external files read by the advisors, and the advisor's own responses.
Ingestion points: User input string, files concerns by the advisor, and the advisor's response transcript.
Boundary markers: The skill explicitly instructs the agent to "capture the response boundary."
Capability inventory: Subprocess execution for CLI tools (claude, codex, opencode) and telemetry logging (omh runtime).
Sanitization: The skill mandates several mitigations including using scratch directories for file isolation, enabling read-only sandbox modes, and explicitly disallowing powerful toolsets (e.g., --disallowedTools "mcp__*").
[DATA_EXFILTRATION]: The analysis identified potential data exposure risks when external coding CLIs are run within a repository containing sensitive files like .env. The skill addresses this by instructing the agent to use scratch directories that do not contain credentials and to exclude secrets unless the user explicitly opts in.

omh-ask