om-merge-buddy
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions mandate loading and applying extension files and project-specific instructions from the repository being scanned, which can be manipulated by an attacker.\n
- Ingestion points: The skill reads repository-local files such as
.ai/skills/om-merge-buddy/SKILL.md,AGENTS.md, andCLAUDE.md, alongside untrusted pull request descriptions and comments.\n - Boundary markers: A specific 'Untrusted content boundary' section in
references/agentic-setup.mddirects the agent to treat repository content as data and explicitly ignore commands like 'ignore previous instructions.'\n - Capability inventory: The skill executes read-only tracker operations (
list-prs,get-pr,list-issue-comments) and can invoke companion skills for setup and PR approval.\n - Sanitization: Guidelines require the agent to redact sensitive credential-looking strings and validate external values like pull request numbers before use in shell commands.\n- [COMMAND_EXECUTION]: The skill utilizes shell-based logic for environment configuration and tracker initialization.\n
- Evidence:
references/agentic-setup.mdcontains bash snippets that usejqto parse the.ai/agentic.config.jsonconfiguration file and check for the existence of tracker descriptors.
Audit Metadata