om-auto-manage-issues
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes tracker operations (get-issue, search-issues, comment-issue) and may delegate to other local skills like
om-auto-write-specorom-root-cause. These are scoped to a predefined tracker descriptor and do not involve arbitrary shell execution or external downloads. - [PROMPT_INJECTION]: The skill explicitly defines an untrusted content boundary in
references/agentic-setup.md. It instructs the agent to treat repository content, tracker issues, and text extracted from screenshots as data rather than instructions. It specifically guards against directives like 'ignore previous instructions' and mandates redacting secrets found in screenshots. - [INDIRECT_PROMPT_INJECTION]: As the skill processes untrusted issue bodies and screenshots, it is technically susceptible to indirect injection. However, it mitigates this by using strict boundary markers (e.g.,
<details>tags for original text), marking inferences clearly, and maintaining a read-only posture regarding the actual codebase (except for optional design-only spec PRs).
Audit Metadata