oma-market
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill architecture requires the agent to read an external instruction file (engine.skillMd) at runtime and treat it as the authoritative protocol for the research task.\n
- Ingestion points: Instructions are ingested from the engine.skillMd file located in the dynamically resolved engine root directory.\n
- Boundary markers: The skill lacks boundary markers; it explicitly directs the agent to follow the external file's instructions exactly and top to bottom.\n
- Capability inventory: The skill possesses the ability to execute shell commands via oma market run and write research briefs to the filesystem.\n
- Sanitization: There is no evidence of sanitization performed on the content of the external instruction file before it is adopted into the agent's context.\n- [EXTERNAL_DOWNLOADS]: The skill uses the oma toolset to synchronize and update the research engine from GitHub.\n
- The oma market update and oma market resolve commands fetch engine components from a remote GitHub repository.\n
- These resources are managed by the vendor (first-fluke) as part of the skill's standard research functionality.\n- [COMMAND_EXECUTION]: The skill executes external CLI tools and scripts to perform research and validation.\n
- It runs the oma market run command to execute Python-based research logic.\n
- It utilizes oma market detect-trap as a preflight gate to validate research topics against safety rules.\n
- The agent is instructed to perform self-checks by executing shell commands (grep, head) against generated research briefs.\n- [DYNAMIC_EXECUTION]: The skill's control flow is determined by environment resolution at runtime.\n
- The oma market resolve command identifies script and configuration paths that the agent then loads and follows.\n
- The agent dynamically adopts logic from the resolved engine.skillMd file to guide its multi-step research process.
Audit Metadata