The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-generated content from issue tracker items and image attachments, creating an indirect prompt injection surface that is heavily restricted and managed through built-in constraints.
Ingestion points: The agent reads issue titles, bodies, user comments, and external screenshots or images in references/enrich-existing-issue.md and references/screenshot-analysis.md.
Boundary markers: Explicit directives in references/agentic-setup.md and references/screenshot-analysis.md mandate that all repository, tracker, and image-extracted text must be handled as data rather than instructions, requiring the agent to ignore any embedded commands.
Capability inventory: Actions are confined to standard issue tracker operations (comment-issue, update-issue, and label guards) and creating a design-only specification PR via om-auto-write-spec. It has no arbitrary code execution or network exfiltration capabilities.
Sanitization: Enforces strict rules requiring the redaction of any credentials, tokens, or environment file secrets discovered during text or screenshot parsing.
[PROMPT_INJECTION]: The static analysis warning regarding the phrase 'ignore previous instructions' in references/agentic-setup.md is a false positive. The text is part of a documentation boundary guide instructing the agent on how to reject prompt injection attempts rather than executing one.

om-auto-manage-issues