omh-provider-profile-posture
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external data including user requests and target context. This data is used to drive a workflow that results in status recording via a CLI tool. While the skill contains rules for evidence boundaries, it lacks explicit sanitization or strict boundary markers for the raw input data.
- Ingestion points: Required inputs include 'user request' and 'target context' as specified in the Catalog Metadata section.
- Boundary markers: The skill instructions do not specify delimiters or 'ignore embedded instructions' markers for these specific inputs.
- Capability inventory: The skill utilizes shell command execution via the 'omh' CLI tool to record runtime evidence.
- Sanitization: No explicit sanitization, validation, or escaping logic is described for the input data before processing.
- [COMMAND_EXECUTION]: The skill utilizes a local CLI tool 'omh' to record workflow status at runtime. The command 'omh runtime record' is used to track the start and state of the provider profile posture process. This command appears to be a standard part of the environment's telemetry or auditing framework.
Audit Metadata