oma-qa
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it is designed to ingest and analyze untrusted data (reviewed code, diffs, and network request logs) without using explicit boundary markers (such as XML tags or delimiters) to isolate this data from the agent's instructions.\n
- Ingestion points: The skill reads external codebase content via the
READSSL primitive and various codebase mapping tools (get_symbols_overview,search_for_pattern) inresources/execution-protocol.md.\n - Boundary markers: The instructions do not specify any delimiters to encapsulate the code being analyzed, which could allow malicious instructions embedded in the user's codebase to influence the agent.\n
- Capability inventory: The skill can execute high-privilege operations including shell commands (
npm audit,bandit,curl) and arbitrary JavaScript within a browser environment (evaluate_script).\n - Sanitization: No sanitization or filtering of external content is specified before the content is processed.\n- [COMMAND_EXECUTION]: The skill's runtime verification protocol in
resources/execution-protocol.mdinvolves executing arbitrary build and test commands found within the user's project (e.g.,bun run dev,uv run manage.py runserver). While these commands are necessary for performing a live audit, they represent a vector where malicious code in a project's build scripts could be executed on the agent's host system.
Audit Metadata