om-fix-issue-multi
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository trackers, such as issues and pull requests, which presents a surface for indirect prompt injection.\n
- Ingestion points: The agent reads issues, PR bodies, diffs, configs, and CI logs as defined in references/agentic-setup.md.\n
- Boundary markers: Uses an 'Untrusted content boundary' that explicitly instructs the agent to disregard directives embedded in data and report them as suspected injections.\n
- Capability inventory: The skill utilizes vendor tools (om-fix-issue) and can execute build/test commands within the project environment.\n
- Sanitization: External values like issue IDs are validated against a strict alphanumeric regex and quoted before shell interpolation.\n- [COMMAND_EXECUTION]: The skill performs shell command execution for building and testing the project code.\n
- Evidence: references/agentic-setup.md permits repository-sourced commands specifically for building, testing, or reviewing the project, while explicitly prohibiting network exfiltration or credential access.\n- [DYNAMIC_EXECUTION]: The skill loads project-specific extensions from the repository at runtime, which involves executing instructions from a local markdown file.\n
- Evidence: references/agentic-setup.md describes loading .ai/skills/om-fix-issue-multi/SKILL.md as a local extension, though it includes logic to verify that these extensions do not relax safety rules or expand access.
Audit Metadata