om-fix-issue-optimized
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions.
- Ingestion points: The skill reads repository and tracker content, including issues, pull request bodies, diffs, documentation, and configuration files (referenced in
references/agentic-setup.md). It also dynamically loads a repo-local.ai/skills/om-fix-issue-optimized/SKILL.mdfile as an extension. - Boundary markers: The skill defines an 'Untrusted content boundary' in
references/agentic-setup.mdthat explicitly instructs the agent to treat repo and tracker content as data, never instructions. - Capability inventory: The skill can execute other workflows (
om-fix-issue,om-setup-agent-harness), modify repository state (via staging fixes), and update tracker labels and comments. - Sanitization: The skill mandates regex validation (
^[A-Za-z0-9._/-]+$) for externally-sourced values before they are used in shell commands or file paths. - [PROMPT_INJECTION]: Static analysis detected patterns associated with instruction overrides.
- Evidence: The file
references/agentic-setup.mdcontains the phrase 'ignore previous instructions'. However, this occurs within a defensive context, instructing the agent to ignore such directives if found in untrusted data rather than attempting to bypass the agent's own safety protocols.
Audit Metadata