omh-legal-compliance-review

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a platform-native command omh runtime record to track the execution status of the legal review workflow. This command is part of the specific Hermes/OMH ecosystem and is used for internal workflow management rather than executing arbitrary or untrusted code.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze external, untrusted content such as contracts, DPAs, and policies, which presents an attack surface for indirect prompt injection.
  • Ingestion points: The skill ingests user-provided contract, policy, and regulatory text for analysis as described in SKILL.md and procedure.md.
  • Boundary markers: The skill includes explicit instructions to 'Distinguish supplied authority from legal interpretation' and 'Fail closed on absent, fabricated, stale, superseded or unverified authority'.
  • Capability inventory: The skill produces structured artifacts (issue matrices, negotiation prep rows) and invokes the omh CLI tool for runtime logging.
  • Sanitization: Strict verification procedures are defined in procedure.md, including legal_authority_citation_check and legal_final_determination_guard, which require exact source pinpointing and prohibit final conclusions if authority is unverified.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 08:33 PM
Security Audit — agent-trust-hub — omh-legal-compliance-review