omh-ops-observability-card
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing data from external telemetry and metric providers to generate observability cards.
- Ingestion points: Untrusted data may enter the context via external metric provider payloads (e.g.,
external_metric_provider/v1) or telemetry from Prometheus/Grafana. - Boundary markers: The skill explicitly instructs the agent to maintain a "prepared-vs-observed boundary" and uses "evidence boundaries" to distinguish between agent guidance and platform truth.
- Capability inventory: The skill utilizes the
omhCLI tool to record workflow status and telemetry metadata. - Sanitization: The instructions include a robust safety rule forbidding the logging of raw prompts, responses, or secret values into telemetry, recommending the use of hashes and counts instead.
- [COMMAND_EXECUTION]: The skill documentation includes a shell command snippet (
omh runtime record) used to initialize and track the status of the observability workflow. This is a platform-native utility for the Hermes environment and is used here for its intended purpose of telemetry recording.
Audit Metadata