omh-spend-gate
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources such as web checkout pages and HTTP 402 challenge payloads to determine payment amounts and recipients. This ingestion creates a surface where malicious instructions could be embedded in the external content to influence agent behavior.\n
- Ingestion points: Extracted from checkout summaries, 402 challenges, and provider usage records in SKILL.md and references/spend-rails.md.\n
- Boundary markers: No specific delimiters or instructions for the agent to ignore embedded natural language commands are present in the data ingestion flow.\n
- Capability inventory: The skill uses browser tools for navigation and clicking, access to payment vaults (browser_vault), and execution of payment-related CLI tools (mppx, pay-cli).\n
- Sanitization: The instructions focus on accurate reading from the source but do not specify any sanitization or validation of the fetched text before processing.\n- [COMMAND_EXECUTION]: The documentation includes shell command examples for status recording (omh runtime record) and references the operational use of several payment-related CLI tools.\n- [EXTERNAL_DOWNLOADS]: The skill mentions and relies on external plugins and optional CLI tools like stripe-link-cli and hermes-mpp for transaction handling on various payment rails.
Audit Metadata