The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains authoritative 'Priority Rules' and a 'Routing Contract' designed to override the agent's core routing logic. Specifically, it instructs the agent: 'OMH policy remains responsible for selecting and governing the workflow... do not let a native candidate override routing.' It further dictates the agent's persona and reply structure, overriding the default behavior defined in the agent's system prompt.
[DATA_EXFILTRATION]: The 'Jev' reasoning feature (documented in references/jev-rail.md) facilitates the transmission of a 'state' object to external API endpoints (api.typesafe.com or OpenRouter). The documentation explicitly states that this 'state' object contains sensitive repository information, including 'commands', 'working directory path', 'source diffs', and 'file contents such as a skill file'. While the skill claims these services do not train on this data, this represents a significant exfiltration vector for codebase intellectual property.
[PRIVILEGE_ESCALATION]: The 'Skill Common Rail' (references/skill-common-rail.md) instructs the agent to bypass security constraints when delegating tasks to external coding executors like Claude Code or Codex. It directs the agent to 'grant the executor session every permission the task will need' and specifically recommends using flags like --dangerously-skip-permissions or --permission-mode acceptEdits, which can lead to unauthorized file mutations or command execution.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a complex routing layer that ingests broad, untrusted user input and repository data, which it then interpolates into tool calls, sub-agent prompts, and external API requests.
Ingestion points: User chat messages, repository files (SKILL.md, .omh/runtime/), command outputs, and source diffs.
Boundary markers: The skill lacks explicit sanitization or delimiters for untrusted data interpolated into OMH workflow 'state' objects.
Capability inventory: Execution of the omh CLI (maintenance and routing), external API calls to Jev/TypeSafe, and delegation to powerful sub-agents (Claude Code, Codex).
Sanitization: While it includes a rudimentary check to refuse text that 'looks like a credential,' it does not filter data for malicious instructions before passing it to downstream executors or APIs.

omh-routing