om-auto-sec-report-pr
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from repository code and tracker data (PR bodies, diffs, issue comments), representing an indirect prompt injection surface. It implements strong mitigations: 1. Ingestion points: PR metadata and diffs, specification files, and repository source code. 2. Boundary markers: Explicit instructions in references/agentic-setup.md mandate treating repository content as data and ignoring embedded directives. 3. Capability inventory: Uses subprocess calls for git and grep, and invokes local companion skills. 4. Sanitization: Implements a 'withhold-live' policy for vulnerabilities and automated redaction gates for secrets.
- [COMMAND_EXECUTION]: The skill executes shell commands (git, grep, sed, jq) using variables derived from the target repository. Mitigation: Externally sourced identifiers are validated against a strict alphanumeric regex (^[A-Za-z0-9._/-]+$) and are quoted during interpolation to prevent injection.
- [DATA_EXFILTRATION]: The skill handles sensitive findings but includes mechanisms to prevent unauthorized exfiltration. Mitigation: The 'disclosure_check' function and 'secret-leak grep' pre-publish gate ensure that sensitive exploit details, credentials, and internal hostnames are withheld or redacted before any report is published. A static detector flagged a prompt injection pattern in references/agentic-setup.md, which is a false positive; the text describes the skill's defensive strategy for ignoring injection attempts in analyzed data.
Audit Metadata