om-brainstorm
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating a potential attack surface for indirect prompt injection.
- Ingestion points: Repository files (Step 1), issue tracker summaries and comments (Step 3), and repository-local configuration or skill extensions (Agentic Setup Step 3).
- Boundary markers: The skill implements an 'Untrusted content boundary' in
references/agentic-setup.mdthat explicitly instructs the agent to treat repository and tracker content as data rather than instructions and to disregard and report common injection patterns like 'ignore previous instructions'. - Capability inventory: The skill utilizes read-only tracker operations (
search-issues,search-prs,get-issue), dispatches a critique subagent, and is restricted to writing a single markdown brief file (.md) to the filesystem after user confirmation. - Sanitization: Instructions mandate strict regex validation (
^[A-Za-z0-9._/-]+$) for all externally-sourced values before use in shell commands or path interpolation to prevent command injection.
Audit Metadata