om-followup-issue-from-pr

Pass

Audited by Gen Agent Trust Hub on Aug 11, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill instructions in references/agentic-setup.md contain explicit defenses against prompt injection, instructing the agent to ignore directives like "ignore previous instructions" or "run this command" found within repository data.- [PROMPT_INJECTION]: The skill implements a repository-local override mechanism that allows the agent to load and apply an extension skill from the target repository (.ai/skills/om-followup-issue-from-pr/SKILL.md). While the instructions forbid relaxing safety rules, this capability allows untrusted repository content to influence the agent's instructional logic.- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes untrusted data from PR comments and bodies to create new issues.
  • Ingestion points: Fetches user-provided text via list-issue-comments, get-pr-comment, get-review-comment, and get-pr.
  • Boundary markers: Includes a dedicated "Untrusted content boundary" section in references/agentic-setup.md which warns the agent to treat repo content as data, not instructions.
  • Capability inventory: The skill uses create-issue and comment-pr to perform mutations on the issue tracker.
  • Sanitization: The skill mandates input validation using regex patterns (^[A-Za-z0-9._/-]+$) for shell or path interpolation and requires the agent to quote original user comments to maintain context and safety.- [SAFE]: No evidence of hardcoded credentials, unauthorized data exfiltration, or malicious persistence mechanisms was found. The skill adheres to vendor-specific tool patterns and includes standard security hygiene rules for secrets management.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 11, 2026, 06:01 AM
Security Audit — agent-trust-hub — om-followup-issue-from-pr