omh-legal-compliance-review
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a platform-native command
omh runtime recordto track the execution status of the legal review workflow. This command is part of the specific Hermes/OMH ecosystem and is used for internal workflow management rather than executing arbitrary or untrusted code. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze external, untrusted content such as contracts, DPAs, and policies, which presents an attack surface for indirect prompt injection.
- Ingestion points: The skill ingests user-provided contract, policy, and regulatory text for analysis as described in
SKILL.mdandprocedure.md. - Boundary markers: The skill includes explicit instructions to 'Distinguish supplied authority from legal interpretation' and 'Fail closed on absent, fabricated, stale, superseded or unverified authority'.
- Capability inventory: The skill produces structured artifacts (issue matrices, negotiation prep rows) and invokes the
omhCLI tool for runtime logging. - Sanitization: Strict verification procedures are defined in
procedure.md, includinglegal_authority_citation_checkandlegal_final_determination_guard, which require exact source pinpointing and prohibit final conclusions if authority is unverified.
Audit Metadata