om-evolve-harness
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted evidence, including session transcripts, pull requests, and issue reports, which creates an indirect prompt injection surface.
- Ingestion points: Untrusted data enters the agent context through the
{evidence}argument and various repository-local files such as issue bodies, PR descriptions, and CI logs. - Boundary markers: The
references/agentic-setup.mdfile defines an explicit 'Untrusted content boundary' and instructs the agent to treat external directives (e.g., 'ignore previous instructions') as data/evidence rather than instructions. - Capability inventory: The skill can execute shell commands defined in
.ai/agentic.config.json(harness.commands.*), read/write files within the repository, and operate within disposable target directories. - Sanitization: The skill mandates several sanitization layers, including regex validation for command arguments (
^[A-Za-z0-9._/-]+$), the redaction of credentials and environment variables, and the use of fresh, disposable write targets to prevent persistent state contamination. - [COMMAND_EXECUTION]: The skill executes shell commands defined in the repository's configuration file (
.ai/agentic.config.json) to drive the evaluation harness. - Evidence: Commands like
validateCase,validateLive, andreleaseare executed as subprocess calls with arguments derived from the processed evidence. - Mitigation: The skill treats these commands as operator-vouched configuration and implements strict placeholder validation and single-quoting to mitigate command injection risks.
Audit Metadata