om-auto-qa-pr
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill includes robust defensive instructions in references/agentic-setup.md to identify and disregard directives embedded in untrusted data sources like PR descriptions or tracker comments. A static analysis warning about instruction overrides was evaluated and confirmed as a false positive, as the text describes defensive boundary enforcement rather than a malicious bypass.
- [COMMAND_EXECUTION]: The skill performs shell operations for git management, JSON processing with jq, and directory creation. It orchestrates other specific vendor-provided tools (om-prepare-test-env, om-auto-review-pr) by their exact names, ensuring that execution remains within the expected functional scope.
- [REMOTE_CODE_EXECUTION]: The skill restores project dependencies (e.g., via npm or pnpm) within a temporary, isolated git worktree when verifying PRs. This is a standard and necessary function for UI testing and is mitigated by the use of isolated environments that do not affect the primary worktree.
- [DATA_EXFILTRATION]: Comprehensive 'Secrets Hygiene' rules are defined in references/rules.md and references/driving-scenario.md. These rules strictly prohibit the surfacing of tokens, API keys, or .env content in any reports, screenshots, or comments, and require the use of dedicated demo credentials for all browser-based verification tasks.
Audit Metadata