om-root-cause
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from issue trackers (e.g., issue bodies and comments) and repository files (e.g., source code and documentation). It identifies a significant attack surface but implements strong mitigations: it explicitly instructs the agent to treat external content as data rather than instructions, to ignore and report common injection patterns (such as "ignore previous instructions"), and to validate all externally sourced values (like issue IDs or slugs) against strict regular expressions before shell or path interpolation. Evidence found in SKILL.md and references/agentic-setup.md.
- [DYNAMIC_EXECUTION]: The skill allows for repository-local extensions by loading configuration and skill overrides from the .ai/ directory within the current repository (references/agentic-setup.md). While this involves dynamic loading from a computed path, the execution is constrained by mandatory safety rules that prohibit local extensions from relaxing security constraints, expanding tool permissions, or redirecting network access.
Audit Metadata