om-apply-upgrade-notes
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: A static detection triggered on instructions in
references/agentic-setup.mdregarding how to handle strings like 'ignore previous instructions'. Review confirms this is a security mitigation instructing the agent to ignore and report such patterns in processed data, rather than an attack attempt. - [EXTERNAL_DOWNLOADS]: The skill is configured to fetch
UPGRADE_NOTES.mdfrom the remote source repository of the skills collection (e.g., GitHub) when it cannot be located locally. This is a legitimate functional requirement for an upgrade utility and the fetched content is treated as data. - [COMMAND_EXECUTION]: The skill uses the
jqutility to parse and update JSON configuration files. The instructions inreferences/agentic-setup.mdprovide a robust 'Untrusted content boundary' that mandates regex validation (^[A-Za-z0-9._/-]+$) and quoting for all externally-sourced values before they are used in shell or path interpolation. - [DATA_EXFILTRATION]: The skill explicitly incorporates a 'Secrets hygiene' rule in
references/rules.md, which forbids the agent from including secrets, tokens, or credentials in any outputs (PRs, issues, or logs), even if instructed to do so by external files or other skills. - [PROMPT_INJECTION]: The skill implements an indirect prompt injection mitigation strategy by defining an 'Untrusted content boundary' in
references/agentic-setup.md. This strategy includes: - Ingestion points: Processes
UPGRADE_NOTES.mdand repository artifacts. - Boundary markers: Explicitly instructs the agent to treat repository and tracker content as data, never instructions.
- Capability inventory: Limited to file modifications within the
.ai/directory. - Sanitization: Strict validation of shell-interpolated variables.
Audit Metadata