om-followup-issue-from-pr
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions in
references/agentic-setup.mdcontain explicit defenses against prompt injection, instructing the agent to ignore directives like "ignore previous instructions" or "run this command" found within repository data.- [PROMPT_INJECTION]: The skill implements a repository-local override mechanism that allows the agent to load and apply an extension skill from the target repository (.ai/skills/om-followup-issue-from-pr/SKILL.md). While the instructions forbid relaxing safety rules, this capability allows untrusted repository content to influence the agent's instructional logic.- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes untrusted data from PR comments and bodies to create new issues. - Ingestion points: Fetches user-provided text via
list-issue-comments,get-pr-comment,get-review-comment, andget-pr. - Boundary markers: Includes a dedicated "Untrusted content boundary" section in
references/agentic-setup.mdwhich warns the agent to treat repo content as data, not instructions. - Capability inventory: The skill uses
create-issueandcomment-prto perform mutations on the issue tracker. - Sanitization: The skill mandates input validation using regex patterns (
^[A-Za-z0-9._/-]+$) for shell or path interpolation and requires the agent to quote original user comments to maintain context and safety.- [SAFE]: No evidence of hardcoded credentials, unauthorized data exfiltration, or malicious persistence mechanisms was found. The skill adheres to vendor-specific tool patterns and includes standard security hygiene rules for secrets management.
Audit Metadata