om-open-pr
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from repository files, tracker issues, and pull request bodies which can contain malicious instructions. 1. Ingestion points: Loading of repo-local instruction files (AGENTS.md, CLAUDE.md), tracker issue descriptions, and pull request comments/diffs. 2. Boundary markers: The references/agentic-setup.md file explicitly defines an 'Untrusted content boundary', instructing the agent to treat repo content as data and ignore embedded directives. 3. Capability inventory: Execution of shell commands (git), filesystem access, and network-enabled tracker API operations. 4. Sanitization: The skill specifies regex-based validation for identifiers (^[A-Za-z0-9._/-]+$) and redaction of credential-like strings.
- [DYNAMIC_EXECUTION]: The skill implements a mechanism in references/agentic-setup.md to load and apply instructions from a repository-local file (.ai/skills/om-open-pr/SKILL.md) at runtime. While it includes negative constraints against relaxing safety rules, this creates a vector for dynamic instruction modification.
- [COMMAND_EXECUTION]: The skill performs shell operations using git to manage branches, commits, and pushes. These operations are controlled by the skill's logic but are influenced by repository state.
- [PROMPT_INJECTION]: The skill includes defensive instructions to detect and report prompt injection attempts ('ignore previous instructions') found in external data sources.
Audit Metadata