om-setup-agent-harness
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATIONPERSISTENCEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs diagnostic and configuration tasks by executing vendor-provided scripts and model CLI tools (e.g., Codex). These executions are scoped to local setup activities and environment probing.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository and issue tracker. It mitigates risk through a dedicated 'Untrusted content boundary' section that explicitly instructs the agent to treat such data as analysis subjects rather than instructions, and validates external parameters using regex.
- [PRIVILEGE_ESCALATION]: The skill installs platform-specific hooks and updates configuration files. These actions are intended to enforce development lifecycle safety gates (e.g., blocking pushes before PR review) rather than gaining system-level administrative privileges.
- [PERSISTENCE]: The installation of pre-tool-use hooks ensures that safety checks remain active across sessions. This is a legitimate functional requirement for the harness's safety enforcement mission.
- [PROMPT_INJECTION]: The instructions include defensive measures that require the agent to prioritize the skill's safety and quality rules over potentially conflicting directives in repository-local extensions, preventing the accidental or malicious weakening of security policies.
Audit Metadata