omh-decision-prototype
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a platform-specific CLI tool
omh(e.g.,omh runtime workflow-artifact decision-prototype prepare) to initialize and manage the state of the prototyping workflow. This is a standard integration for the 'Oh-My-Hermes' framework referenced in the skill metadata. - [DYNAMIC_EXECUTION]: The core purpose of the skill is to generate and execute 'exact commands' to test technical hypotheses. To mitigate the risk of arbitrary code execution, the skill mandates a 'scratch boundary' (isolated directory or temporary worktree) and requires synthetic fixtures instead of production data.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input, such as 'decision questions' and 'hypotheses'. It implements significant guardrails, including requiring a 'falsifiable hypothesis', budget units (time, tools, files), and explicit verification that the agent is writing within the declared isolation boundary.
Audit Metadata