omakase-router

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No malicious patterns, such as obfuscation, hardcoded credentials, or unauthorized persistence mechanisms, were detected in any of the skill files.
  • [COMMAND_EXECUTION]: The skill utilizes standard command-line tools such as git and npm to perform project maintenance and verification tasks. For example, git log is used for summarizing project history, and npm run build is used for packaging. These operations are transparently documented and consistent with the skill's purpose as a developer tool.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for initializing a project using npx omakaseagent init. This command downloads and executes a project-specific package from the npm registry, which is a standard procedure for bootstrapping development environments.
  • [DATA_EXPOSURE]: The 'Archivist' persona is designed to process chat history and git logs to extract and encode project-specific preferences ('taste'). The skill includes non-negotiable standards that explicitly prohibit the inclusion of raw chat dumps, secrets, customer data, or credentials in its output, effectively mitigating data exfiltration risks.
  • [PROMPT_INJECTION]: The skill defines a strict set of internal rules and rubrics (Omakase Core) to control agent behavior. While these instructions are authoritative, they are intended to maintain high output quality and do not attempt to override the underlying LLM's safety guardrails or instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 04:00 PM
Security Audit — agent-trust-hub — omakase-router