omh-model-setup
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata from session history and local configuration files, which is a potential surface for indirect prompt injection.
- Ingestion points: Historical session metadata and configuration files located in
~/.omh/routing/. - Boundary markers: The instructions explicitly mandate the use of a "safe allowlist" for metadata and instruct the agent to treat discovery sources as "untrusted metadata sources."
- Capability inventory: The skill enables the agent to execute specific CLI commands (
omh,hermes) and modify JSON configuration files in the~/.omh/directory. - Sanitization: The workflow includes strong sanitization practices, such as forbidding the reading of
.envfiles or secrets, and requiring a "diff-approved apply" step where users must explicitly confirm any changes before they are written. - [COMMAND_EXECUTION]: The skill utilizes a domain-specific CLI toolset for diagnostic and configuration tasks.
- Evidence: Instructions include the use of
omh model-chains,hermes auth, andomh runtime recordto inspect and manage model aliases and provider states.
Audit Metadata