omakase-router
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, such as obfuscation, hardcoded credentials, or unauthorized persistence mechanisms, were detected in any of the skill files.
- [COMMAND_EXECUTION]: The skill utilizes standard command-line tools such as
gitandnpmto perform project maintenance and verification tasks. For example,git logis used for summarizing project history, andnpm run buildis used for packaging. These operations are transparently documented and consistent with the skill's purpose as a developer tool. - [EXTERNAL_DOWNLOADS]: The skill provides instructions for initializing a project using
npx omakaseagent init. This command downloads and executes a project-specific package from the npm registry, which is a standard procedure for bootstrapping development environments. - [DATA_EXPOSURE]: The 'Archivist' persona is designed to process chat history and git logs to extract and encode project-specific preferences ('taste'). The skill includes non-negotiable standards that explicitly prohibit the inclusion of raw chat dumps, secrets, customer data, or credentials in its output, effectively mitigating data exfiltration risks.
- [PROMPT_INJECTION]: The skill defines a strict set of internal rules and rubrics (Omakase Core) to control agent behavior. While these instructions are authoritative, they are intended to maintain high output quality and do not attempt to override the underlying LLM's safety guardrails or instructions.
Audit Metadata