om-verify-in-repo
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection because it processes untrusted content from GitHub issue trackers.
- Ingestion points: Workflow steps 1 and 3 ingest issue bodies, titles, and comments using the
get-issueandsearch-prstools in SKILL.md. - Boundary markers: The
references/agentic-setup.mdfile defines an explicit "Untrusted content boundary," instructing the agent to treat external content as data and ignore embedded directives like "ignore previous instructions." - Capability inventory: The skill's operations are strictly read-only, limited to file reading and non-mutating tracker/git commands (
git log,get-issue,repo-info), which prevents unauthorized state changes. - Sanitization: The agent is explicitly instructed in
references/agentic-setup.mdto validate all externally-sourced values (issue IDs, branches, etc.) against the regex^[A-Za-z0-9._/-]+$before interpolation and to ensure all values are quoted. - [PROMPT_INJECTION]: A static detector flagged potential prompt injection in
references/agentic-setup.mdregarding instructions to ignore previous directives. This is a false positive; the identified text is a defensive security instruction telling the AI to ignore malicious payloads in untrusted data, not an attempt to hijack the agent. - [COMMAND_EXECUTION]: The skill dynamically loads repository-local markdown instructions as extensions, which allows for local behavior modification.
- Evidence:
references/agentic-setup.mddirects the agent to load and apply.ai/skills/om-verify-in-repo/SKILL.mdas an extension if it exists. - Context: While this allows repository-specific behavior, the skill includes a safety override forbidding the extension from relaxing security rules, quality rules, or tool access.
Audit Metadata