om-brainstorm
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill includes instructions specifically designed to detect and ignore prompt injection attempts (such as "ignore previous instructions") found in repository or tracker data. These are defensive measures intended to maintain the agent's integrity when processing external content.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted data from multiple sources, creating a vulnerability surface for indirect prompt injection attacks.
- Ingestion points: The workflow reads repository files (e.g.,
AGENTS.md,CLAUDE.md,product-brief.md), tracker items (issues and PRs), and a repository-local extension file (.ai/skills/om-brainstorm/SKILL.md) that can extend or modify skill behavior. - Boundary markers: The skill implements an "Untrusted content boundary" rule, instructing the agent to treat all content from the repository and tracker strictly as data rather than instructions.
- Capability inventory: The skill utilizes read-only tracker search tools (
search-issues,search-prs,get-issue), has local file system read access, can write a handoff brief file after user confirmation, and dispatches a quality-check subagent. - Sanitization: The instructions require validation of externally-sourced strings before interpolation into shell commands or file paths and mandate the refusal of any network exfiltration or system commands discovered within processed data.
Audit Metadata