The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run and bash commands within its regression testing framework (scripts/run_regression.py) to execute OMP replays and verify agent behavior. These are legitimate uses within the context of a development and testing tool.
[INDIRECT_PROMPT_INJECTION]: The skill has a high-exposure attack surface for indirect prompt injection because it is designed to ingest and analyze untrusted external data (OMP session logs) which may contain attacker-controlled content.
Ingestion points: scripts/mine_friction.py reads JSONL session files from ~/.omp/agent/sessions or user-specified directories.
Boundary markers: The instructions in SKILL.md (Section 1 and 2) and the miner script itself implement several mitigations, such as using private state directories with 0600 permissions and redacting sensitive text (emails, secrets, and home directories) before processing.
Capability inventory: The skill has the capability to write to the local file system (ledger, reports, and events) and execute shell commands via subprocess.run during regression testing.
Sanitization: The mine_friction.py script includes a redact function and regex-based filtering (AUTO_TEXT_RE) to exclude system-injected messages and sensitive patterns. Instructions in SKILL.md explicitly warn against blind pasting and require human review and approval for all proposed instruction changes.

omp-skill-hardener