omh-market-research

Pass

Audited by Gen Agent Trust Hub on Nov 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a framework-specific command (omh runtime record) within SKILL.md to track execution status. This is a static command used for internal telemetry and does not accept untrusted user arguments.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external market data, customer reviews, and competitive intelligence.
  • Ingestion points: User-provided research data and external references loaded via skill_view in SKILL.md.
  • Boundary markers: The instructions emphasize the use of Source IDs (S1), Evidence IDs (E1), and Quotation IDs (Q1) to clearly demarcate and attribute external data.
  • Capability inventory: Shell execution of status commands and loading of external framework instructions.
  • Sanitization: Explicit rules in references/customer-evidence.md and SKILL.md require the agent to use pseudonymous IDs, avoid PII, and distinguish between observed behavior, stated intent, and analyst inference.
  • [EXTERNAL_DOWNLOADS]: The skill references other components of the 'oh-my-hermes' framework (e.g., skill-common-rail.md) using the platform-specific skill_view mechanism. These are internal project references rather than arbitrary remote downloads.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 9, 2026, 12:35 AM