omh-meta-router
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
omhcommand-line tool (specificallyomh recommend "<remainder>" --json --limit 3) using arguments derived directly from user input. While the instructions suggest wrapping the input in double quotes, passing untrusted strings to a shell environment creates a potential command injection surface. Additionally, the skill indicates that some catalog results may be rendered without user approval if the surrounding metadata is deemed sufficient.\n- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and reason over untrusted user tasks to determine subsequent agent actions, which is a surface for indirect instructions to influence the agent.\n - Ingestion points: The skill parses the 'task remainder' from user messages starting with the
/omhor./omhcommand tokens inSKILL.md.\n - Boundary markers: The skill recommends using double quotes to delimit the user input in CLI calls, but it lacks specific boundary markers or instructions to ignore embedded commands during the agent's internal reasoning phase.\n
- Capability inventory: The skill possesses the ability to execute shell commands (
omh) and read local reference files via theskill_viewfunction (e.g.,references/catalog-index.md).\n - Sanitization: No explicit sanitization, validation, or escaping of the user-provided 'task remainder' is mentioned before it is processed or passed to the tool surface.
Audit Metadata