oma-skill-creation
Warn
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: MEDIUMMETADATA_POISONINGINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [METADATA_POISONING]: The skill's supporting resources contain references to non-existent or synthetic information sources, such as a blog post on 'GPT-6 Astra' and an arXiv paper ('SkillLens', arXiv:2605.23899) supposedly dated May 2026. These fake citations appear intended to give the skill's authoring principles a false sense of authority or to influence the behavior of the AI agent based on non-existent guidelines.
- [INDIRECT_PROMPT_INJECTION]: The skill functions as a code and instruction generator that ingests untrusted user content (e.g., 'skill purpose', 'triggers', and 'user edits to preserve') to produce the logic for secondary skills. This creates a surface where malicious user input could be embedded into the instruction set of other skills, affecting their future routing or behavior.
- Ingestion points: Input parameters including skill purpose and user-provided triggers collected in the Expected Inputs section.
- Boundary markers: Uses markdown headers and YAML frontmatter to structure the generated skill files, but lacks logic to prevent users from injecting conflicting or malicious instructions into intent signatures or workflow paths.
- Capability inventory: Employs the 'oma' CLI suite (lint, audit, eval, verify) for automation and various shell tools (git, awk, rg) for file and repository manipulation.
- Sanitization: There is no evidence of sanitization or filtering for the user-supplied strings before they are incorporated into the executable instruction blocks or metadata of the generated skills.
- [COMMAND_EXECUTION]: The skill defines a workflow involving the local execution of shell commands, including 'oma skill lint', 'oma skill audit', 'git diff', 'awk', and 'rg', to perform structural validation and repository auditing of the authored skills.
Audit Metadata