omh-operating-rhythm
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of meeting and retro notes.
- Ingestion points: The skill requires 'source notes' as input for record preparation in SKILL.md.
- Boundary markers: Instructions specify the use of an 'explicit missing-notes boundary' and an 'observed/prepared boundary' to distinguish between generated and observed content.
- Capability inventory: The skill utilizes 'skill_view' for referencing shared configurations and an 'omh' CLI tool for status recording.
- Sanitization: The skill implements logic to mark unverified owners, dates, or decisions as 'unknown' or 'unresolved' until explicitly confirmed.
- [COMMAND_EXECUTION]: The skill provides instructions for utilizing a vendor-specific command-line interface for status tracking.
- Evidence: The skill documents the use of 'omh runtime record' to signal the start and status of the workflow execution.
Audit Metadata