omh-prompt-import-readiness
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to import prompt files from external sources such as Claude Code and Codex, which creates a surface for indirect prompt injection if those files contain malicious instructions.
- Ingestion points: Processes external prompt folders and directory-based prompt imports as specified in
SKILL.md. - Boundary markers: The skill explicitly defines 'prepared-vs-observed' boundaries and safety rules to prevent unverified execution.
- Capability inventory: Involves prompt mutation, dry-run execution, and slash-command registration.
- Sanitization: The workflow includes specific recovery notes requiring a
security-safety-reviewfor suspicious prompt content or potential injection risks. - [DYNAMIC_EXECUTION]: The skill utilizes dynamic argument interpolation to map user inputs to imported slash commands.
- Evidence: References to
$ARGUMENTSmapping,$1-$9argument syntax, and{{args}}placeholders inSKILL.md.
Audit Metadata