om-setup-agent-pipeline
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various shell commands through defined tracker descriptors (GitHub, GitLab, Jira, Linear) and browser providers to manage repository metadata, pull requests, and CI/CD runs. These commands are gated by strict validation rules and use established CLI tools (gh, glab, acli, linear).
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the 'agent-browser' binary from a trusted organization (Vercel Labs) on GitHub. This process includes mandatory SHA-256 checksum verification before execution to ensure binary integrity.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from repository files and issue trackers. It mitigates injection risks by defining an 'Untrusted content boundary' that instructs the agent to treat external directives as data rather than instructions, and it validates all externally-sourced identifiers before use in shell interpolation.
- [PRIVILEGE_ESCALATION]: The browser setup script includes a check for 'sudo -n' to install system dependencies on Linux. This is a limited and non-interactive use of privileges that only triggers if the environment is already configured for passwordless elevation or if the process is already running as root.
- [PROMPT_INJECTION]: Static analysis identified instruction override patterns in 'references/agentic-setup.md'; however, these are false positives as the text describes defensive protocols for the agent to follow when encountering malicious prompts in external data.
Audit Metadata