The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to execute repository-defined shell commands (via the validation.commands configuration) to validate changes before opening or updating a PR. While this is a high-privilege capability, it is restricted to commands explicitly defined in the project's .ai/agentic.config.json and is core to the skill's intended purpose of ensuring code quality.
[EXTERNAL_DOWNLOADS]: The skill supports fetching external reference material via operator-supplied --skill-url arguments. Security is maintained through strict handling rules defined in references/external-skill-urls.md, which specify that fetched content must be treated as non-authoritative reference data, conflicts with project rules are resolved in favor of the project, and the agent is explicitly forbidden from executing commands or bypassing security gates based on external content.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources, including task briefs, external URLs, and repository/tracker content. It mitigates this risk by implementing an 'Untrusted content boundary' in references/agentic-setup.md that instructs the agent to treat these sources strictly as data, refuse embedded instructions (e.g., 'ignore previous instructions'), and report them as suspected injection attempts.
Ingestion points: Task {brief} (SKILL.md), external reference content (references/external-skill-urls.md), and tracker issue/PR data (references/claim-pr.md).
Boundary markers: The 'Untrusted content boundary' section in references/agentic-setup.md provides explicit instructions to disregard and report embedded directives.
Capability inventory: Git worktree operations, shell execution of validation scripts, network fetching of reference URLs, and tracker API mutations (PR creation, labeling, and commenting).
Sanitization: The skill enforces mandatory redaction of secrets and credentials (SKILL.md) and requires validation of externally-sourced values before shell interpolation (references/agentic-setup.md).
[CREDENTIALS_SAFE]: The skill includes explicit instructions in its 'Security boundaries' (SKILL.md) and 'Shared rules' (references/rules.md) to ensure that secrets, tokens, and .env contents never enter model output or tracker comments, even if explicitly requested by external data.

om-auto-create-pr