ulw-execute

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill is designed to orchestrate complex software development workflows by delegating implementation, testing, and QA tasks to subagents. It defines a robust management system using "Boulder" state and evidence ledgers to track progress and ensure verification rigor.
  • [EXTERNAL_DOWNLOADS]: The skill references the agent-browser tool from Vercel Labs (github.com/vercel-labs/agent-browser) as a recommended utility for browser-based manual QA. This reference targets a repository from a well-known and trusted organization.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external plan files located in .omo/plans/ and feedback data (DoneClaim JSON) from subagents. This architecture represents a surface for indirect prompt injection if the plans or subagent outputs originate from untrusted sources.
  • Ingestion points: The skill reads work plans from .omo/plans/*.md, session state from .omo/boulder.json, and result messages from spawned subagents.
  • Boundary markers: The skill does not explicitly define delimiters or specific "ignore" instructions when interpolating plan content into the orchestrator's context, as the plan itself serves as the set of instructions.
  • Capability inventory: The skill has the capability to spawn subagents (multi_agent_v1.spawn_agent), perform Git operations (worktree management, merging, pushing), write to the local file system (.omo/ directory), and execute commands through delegated workers.
  • Sanitization: The instructions focus on verification of work (adversarial QA) rather than sanitization of the plan content itself, though the "No-plan bootstrap" process includes an "adversarial plan-review" step as a design-time mitigation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 06:00 PM
Security Audit — agent-trust-hub — ulw-execute