omh-product-brief
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
omhcommand-line utility within shell blocks to record workflow state and status in the planning harness. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted 'product evidence' from external sources such as user feedback and behavioral data. This creates a standard surface for indirect prompt injection, although the skill defines boundary markers and validation steps to separate evidence from requirements.
- [SAFE]: The skill follows established patterns for the Oh-My-Hermes framework and does not exhibit signs of exfiltration, obfuscation, or unauthorized access.
Audit Metadata