omh-sales-pipeline-review
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill implements a structured sales pipeline review workflow that focuses on analyzing supplied CRM data. It explicitly states that it does not perform data mutations, store CRM data, or send outreach, delegating such actions to a connector boundary which ensures separation of concerns.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted CRM data exports (CSV/JSON snapshots), which represents a vulnerability surface for indirect prompt injection. However, this is mitigated by a mandatory scope validation phase (sales_pipeline_scope_check) and explicit safety rules that restrict the persistence of raw input data to durable artifacts, focusing instead on bounded aggregates.
- [COMMAND_EXECUTION]: The skill references vendor-specific CLI tools (omh runtime) for preparing workflow artifacts. These references are part of the framework's documented operational procedure and do not involve arbitrary command execution or shell injection vectors.
Audit Metadata