The Agent Skills Directory

[SAFE]: The skill follows security best practices for autonomous agents, including the use of isolated worktrees for code modification and a dedicated secrets hygiene policy that prevents the exfiltration of sensitive tokens or configuration files into public logs or comments.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from pull request bodies and tracker issues, creating a theoretical attack surface. However, it mitigates this risk with a documented 'Untrusted content boundary'.
Ingestion points: Untrusted data enters the agent context through PR descriptions, code diffs, and issue comments read via tracker operations (SKILL.md, references/agentic-setup.md).
Boundary markers: The references/agentic-setup.md file explicitly instructs the agent to treat external content as data, not instructions, and to report any directives that attempt to override system rules.
Capability inventory: The skill has the ability to execute shell commands for git operations and CI validation, perform file writes via git commits, and interact with external APIs to manage pull requests.
Sanitization: The agent is instructed to validate externally-sourced values like PR numbers and branch names against strict regex patterns before using them in shell commands or file paths.
[COMMAND_EXECUTION]: The skill executes git commands and project-specific validation scripts. These operations are restricted to an isolated worktree created specifically for the run (.ai/tmp/om-auto-fix-pr/), preventing potential side effects on the primary user environment.
[CREDENTIALS_UNSAFE]: The skill includes a robust secrets handling policy in references/rules.md, requiring the redaction of API keys, tokens, and .env content before they are included in any agent output or tracker comments.

om-auto-fix-pr