omh-deep-research
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill architecture creates a surface for indirect prompt injection by ingesting and processing untrusted web data.
- Ingestion points: Untrusted external data enters the system through the
web_searchandweb_extracttools executed by delegated researcher subagents. - Boundary markers: In Phase 4 (Synthesize) and Phase 5 (Verify), the parent skill concatenates the "full contents" of these findings directly into the next subagent's prompt context without using explicit delimiters (e.g., XML tags) or providing "ignore embedded instructions" warnings.
- Capability inventory: The skill has the capability to write research reports and findings to the local filesystem and manipulate persistent state via the
omh_statetool. - Sanitization: There is no evidence of data sanitization, filtering, or validation performed on the external web content before it is interpolated into downstream subagent tasks.
Audit Metadata