omnigraph-best-practices
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides a shell command to download and execute a bootstrap script from the developer's official repository on GitHub (ModernRelay/omnigraph). This script is used to set up a local development environment involving Docker and the Omnigraph server.
- [COMMAND_EXECUTION]: Instructions include several shell commands for interacting with the Omnigraph CLI, such as initializing repositories, applying schemas, and loading data. These commands are integral to the tool's functionality.
- [EXTERNAL_DOWNLOADS]: The skill references external resources including the bootstrap script and official Docker documentation for environment setup.
- [DATA_EXFILTRATION]: The skill describes handling AWS credentials and bearer tokens for database access. It correctly recommends storing these in a git-ignored .env.omni file to prevent accidental exposure and ensure secrets are managed securely.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes external graph data. Ingestion points: Untrusted data enters the agent context through 'omnigraph load' and 'omnigraph ingest' as described in references/data.md. Boundary markers: The skill does not provide explicit boundary markers for the data content itself but mandates parameterization for queries. Capability inventory: The agent can execute CLI commands, perform file system operations, and make network requests to S3 or HTTP endpoints. Sanitization: Rule 5 in SKILL.md ('Parameterize everything') explicitly mandates the use of typed parameters in queries to prevent injection attacks during database operations.
Audit Metadata