omh-agent-evaluation
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data including task sets, fixtures, and observed run artifacts from external candidate agents.
- Ingestion points: External data enters the context via task sets, fixtures, and observed artifacts during the evaluation and scoring phases (defined in
SKILL.md). - Boundary markers: The skill explicitly defines and enforces an 'evidence boundary' and 'not-evidence boundary' to separate prepared analysis from verified runtime data.
- Capability inventory: The skill utilizes the
omhCLI toolset for dispatching runs (omh coding paired-run dispatch) and recording results (omh runtime record), but restricts execution of unverified candidate arms. - Sanitization: provenance is verified through 'receipt-authenticated observed_at' mechanisms and signed local receipts to ensure data integrity.
- [DATA_EXPOSURE]: The skill includes explicit safety instructions that prohibit the transmission of secrets, credentials, or private production data into the evaluation environment without explicit authority, following standard security best practices.
Audit Metadata