The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository files, issues, and Pull Requests, which represents a potential attack surface.
Ingestion points: references/spec-resolution.md and SKILL.md describe reading external data including issue bodies and spec files.
Boundary markers: references/agentic-setup.md establishes a mandatory 'Untrusted content boundary,' instructing the agent to treat repository content strictly as data and ignore embedded directives.
Capability inventory: The skill utilizes git operations, file system access, and tracker operations through engine skills.
Sanitization: Implements regex validation for identifiers and requires quoting for shell interpolation.
[COMMAND_EXECUTION]: Performs git operations and invokes tracker tools to manage the development lifecycle.
Evidence: SKILL.md and references/pr-finalize.md detail git worktree management and the use of operations like create-pr or mark-pr-ready.
Mitigation: Execution is scoped to the local repository and restricted to operations defined in the environment configuration.
[DYNAMIC_EXECUTION]: The skill supports repository-local configuration overrides.
Evidence: references/agentic-setup.md describes loading a local extension from .ai/skills/om-auto-implement-spec/SKILL.md.
Mitigation: The preflight check explicitly forbids these overrides from relaxing safety rules or expanding access permissions.
[PROMPT_INJECTION]: (False Positive) Skill documentation contains strings associated with prompt injection patterns.
Evidence: Found in references/agentic-setup.md within the 'Untrusted content boundary' section.
Context: These strings appear within defensive instructions telling the agent to ignore commands like 'ignore previous instructions' if encountered in untrusted data, representing a security best practice.

om-auto-implement-spec