om-auto-review-pr
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill contains explicit defensive instructions in
references/agentic-setup.mdto identify and ignore common prompt injection patterns like 'ignore previous instructions' or 'run this command' when encountered in repository data or PR comments. - [DATA_EXFILTRATION]: The skill implements strict 'secrets hygiene' rules, forbidding the posting of tokens, credentials, or
.envcontents into PR comments or logs. It also explicitly refuses network operations that would exfiltrate data. - [COMMAND_EXECUTION]: The skill performs necessary shell operations using
gitand local build tools (npm, cargo, etc.) within isolated worktrees. These are scoped to the project's own validation commands and are used for reviewing and fixing code as intended. - [INDIRECT_PROMPT_INJECTION]: The skill recognizes the attack surface created by processing untrusted PR metadata and comments. It mitigates this by enforcing an 'untrusted content boundary', validating externally-sourced values, and requiring the agent to treat such content strictly as data.
Audit Metadata