omh-triage
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from GitHub issue bodies and passes this content to sub-agents via the delegate_task tool, creating a surface for indirect prompt injection. \n
- Ingestion points: SKILL.md Phase 0, Step 2 describes fetching issue bodies using gh issue list. \n
- Boundary markers: No delimiters or "ignore embedded instructions" warnings are documented when passing issue content to sub-agents in Phase 1. \n
- Capability inventory: The skill utilizes gh issue list, gh issue close, git commit, and file system writes to /tmp/. \n
- Sanitization: No sanitization of issue content is mentioned before use in prompts or files. \n
- Mitigation: Wrap external content in delimiters with explicit instructions for the agent to ignore any instructions contained within the data. \n- [COMMAND_EXECUTION]: The execution pattern described in Pitfall T3 involves shell interpolation to read comment bodies from files (gh issue close --comment "$(cat /tmp/closeN.md)"). This pattern can be vulnerable to command injection if the content of the triage files contains shell metacharacters. \n
- Mitigation: Use tool flags that read directly from a file without shell evaluation to ensure the execution environment handles the string as a literal.
Audit Metadata