omh-llm-app-dev
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that processes untrusted data from external sources such as retrieved documents, user uploads, and public board content, which is a common vector for indirect prompt injection.
- Ingestion points: SKILL.md and references/public-board.md specify ingestion of data from URLs, file uploads, and external message boards.
- Boundary markers: Guidelines mandate the use of fencing and specific labeling to isolate untrusted content from the instruction channel.
- Capability inventory: The workflow involves external writes to public boards and stateful interactions with business records through backend authoritative systems.
- Sanitization: The skill requires schema-validation of all model outputs and ensures tools operate under least-privilege principles to limit the impact of potentially malicious data.
- [DATA_EXFILTRATION]: The skill includes protocols for transmitting data to external public communication platforms.
- Evidence: The references/public-board.md file outlines requirements for outbound writes, including post bodies and attachments to external destinations.
- Mitigations: The protocol enforces strict data minimization, clear public-audience label, and mandatory host-recorded human approval for all outbound payloads to prevent unauthorized exfiltration.
- [COMMAND_EXECUTION]: The evaluation system includes the execution of code-based validators to verify the correctness of the application's output.
- Evidence: The references/eval-harness.md document describes using programmatic property checks and deterministic validators as part of the golden set evaluation process.
- Context: These executions are restricted to the local development and testing environment as part of a standard software quality assurance suite.
Audit Metadata