omh-agent-debug
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a forensic tool that ingests untrusted data from past session transcripts, logs, and databases, creating a surface for indirect prompt injection.
- Ingestion points: Accesses
state.db(SQLite), JSON Lines session records, and delegated child transcripts. - Boundary markers: Employs message ID citations, record line numbers, and 'not-evidence' boundaries to distinguish session data from instructions.
- Capability inventory: Executes
omhCLI commands andsqlite3for data retrieval; supports data export only after explicit user confirmation (--confirm-export). - Sanitization: Implements strict read-only URI modes (
mode=ro), per-line byte caps (--max-row-bytes), and SQL-level substring capping (substr(content, 1, <cap>)) to prevent context flooding and data tampering. - [COMMAND_EXECUTION]: The skill utilizes system commands to perform its diagnostic functions.
- Evidence: Uses
sqlite3to query internal databases and variousomhruntime/quality commands (e.g.,omh quality-evidence,omh runtime record) to collect environment and session metadata.
Audit Metadata