om-check-and-commit
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill includes strong defensive instructions to recognize and ignore malicious directives embedded in repository content, specifically mentioning patterns like "ignore previous instructions" as untrusted data.
- [DATA_EXFILTRATION]: It implements a "Secrets hygiene" policy that strictly prohibits the leakage of tokens, credentials, or environment variables into pull request comments or logs, even if instructed by external data.
- [COMMAND_EXECUTION]: The skill executes validation commands defined in the project's local configuration file (
.ai/agentic.config.json). It restricts these executions to build, test, and review scopes and includes regex validation for externally-sourced values like branch names or PR numbers to prevent command injection. - [SAFE]: The workflow follows development best practices, such as requiring explicit user confirmation before pushing code, using conventional commit messages, and enforcing the use of commit hooks without overrides.
Audit Metadata