om-pr-autopilot
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill implements a robust 'Untrusted content boundary' in
references/agentic-setup.md. It explicitly directs the agent to treat repository content (PR bodies, diffs, comments) as data rather than instructions, and to specifically ignore and report attempts to override system prompts or execute arbitrary commands found in that data. - [CREDENTIALS_UNSAFE]: A strict 'Secrets hygiene' policy is defined in
references/rules.md. This rule prevents the agent from exfiltrating or surfacing sensitive information like.envfiles, tokens, or credentials, even when requested by external instructions. - [COMMAND_EXECUTION]: To mitigate command injection risks, the skill mandates validation of externally-sourced values (such as branch names, PR numbers, or tracker IDs) using a restrictive regex (
^[A-Za-z0-9._/-]+$) before they are used in shell commands or path interpolation. - [SAFE]: The skill permits repo-local instruction overrides via
.ai/skills/om-pr-autopilot/SKILL.md. This ingestion point for external instructions is managed by clear boundary markers inreferences/agentic-setup.mdthat instruct the agent to skip any directives attempting to relax safety rules or expand tool access, effectively sanitizing the repository-provided configuration against malicious escalation.
Audit Metadata