distill
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and cluster findings from accumulated project data, which may include content from external sources or past sessions containing instructions.
- Ingestion points: The skill ingests data using the
oh_search_contexttool and by reviewing conversation history inSKILL.md. - Boundary markers: The instructions do not specify any delimiters or safety markers to isolate the analyzed data from the agent's control logic.
- Capability inventory: The agent can write to files within the
.oh/metis/and.oh/guardrails/directories, which are used to store project context and constraints. - Sanitization: No explicit sanitization or filtering logic is provided; however, the skill mandates a human-in-the-loop process where the user must approve all proposed actions (Keep, Promote, Compact, Dismiss) before any files are modified.
Audit Metadata