om-implement-feature-multi
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill incorporates defensive patterns to identify and neutralize prompt injection attempts found in external data. It specifically instructs the agent to ignore directives like 'ignore previous instructions' and report them instead of complying.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from repository trackers and pull requests. It mitigates potential risks through a comprehensive 'Untrusted content boundary' policy.
- Ingestion points: Repository content, tracker issues, and PR bodies/diffs as defined in
references/agentic-setup.md. - Boundary markers: Explicit instructions are provided to treat directives in these sources as data and to report suspected injections.
- Capability inventory: The skill invokes the base
om-implement-featureworkflow for staged feature development, involving local file system operations (SKILL.md). - Sanitization: Externally-sourced strings such as issue IDs and slugs are validated against a strict alphanumeric regex (
^[A-Za-z0-9._/-]+$) before any shell interpolation occurs. - [CREDENTIALS_UNSAFE]: The skill defines a 'Secrets hygiene' protocol in
references/rules.md, which prohibits the inclusion of API tokens, environment variables, or other credentials in comments, logs, or plan files, even if requested by external inputs.
Audit Metadata