ulw-execute
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is designed to orchestrate complex software development workflows by delegating implementation, testing, and QA tasks to subagents. It defines a robust management system using "Boulder" state and evidence ledgers to track progress and ensure verification rigor.
- [EXTERNAL_DOWNLOADS]: The skill references the
agent-browsertool from Vercel Labs (github.com/vercel-labs/agent-browser) as a recommended utility for browser-based manual QA. This reference targets a repository from a well-known and trusted organization. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external plan files located in
.omo/plans/and feedback data (DoneClaimJSON) from subagents. This architecture represents a surface for indirect prompt injection if the plans or subagent outputs originate from untrusted sources. - Ingestion points: The skill reads work plans from
.omo/plans/*.md, session state from.omo/boulder.json, and result messages from spawned subagents. - Boundary markers: The skill does not explicitly define delimiters or specific "ignore" instructions when interpolating plan content into the orchestrator's context, as the plan itself serves as the set of instructions.
- Capability inventory: The skill has the capability to spawn subagents (
multi_agent_v1.spawn_agent), perform Git operations (worktree management, merging, pushing), write to the local file system (.omo/directory), and execute commands through delegated workers. - Sanitization: The instructions focus on verification of work (adversarial QA) rather than sanitization of the plan content itself, though the "No-plan bootstrap" process includes an "adversarial plan-review" step as a design-time mitigation.
Audit Metadata