The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (issue trackers, source code) and possesses the capabilities required to be a target for injection. * Ingestion points: Processes the {issueId}, external tracker items, and the 'analyzer brief' block from the previous step. * Boundary markers: The analyzer brief is delimited by specific start/end markers in the prompt. * Capability inventory: Possesses full shell access for testing and file-system write access across the repository. * Sanitization: The instructions contain explicit directives to treat all repository/tracker content as data, refuse embedded commands (e.g., 'ignore previous instructions'), and validate all external values before interpolation into shell commands or paths.
[COMMAND_EXECUTION]: The skill executes arbitrary shell commands based on the repository's configuration. * Evidence: The workflow involves running every command listed in the validation.commands field of the local .ai/agentic.config.json file. * Context: These commands are used for project validation, but the reliance on repository-provided configuration introduces a vector if the configuration file is compromised.
[DYNAMIC_EXECUTION]: The skill dynamically loads configuration and extension instructions from the target repository. * Evidence: The skill loads a repository-local .ai/skills/om-fix/SKILL.md file as an extension and uses .ai/agentic.config.json for operational parameters. * Context: While instructions include a safety guard to ignore directives that relax safety rules or expand tool access, this mechanism allows the repository to influence the agent's logic.

om-fix