omh-triage
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes GitHub issue bodies which are untrusted external data. These inputs are passed to sub-agents (Maintainer and Skeptic roles) to determine the status of backlog items.
- Ingestion points: Issue inventory and full issue bodies are gathered in Phase 0 and passed to sub-agents in Phase 1 (SKILL.md).
- Boundary markers: The instructions use placeholder tags (e.g.,
<full issue bodies>) to delimit data, but do not explicitly instruct the sub-agents to ignore instructions embedded within those bodies. - Capability inventory: The orchestrator has the capability to execute shell commands via the terminal to close issues, post comments, and commit files (SKILL.md Phase 3).
- Sanitization: No explicit sanitization or filtering of the issue body content is described before it is processed by the LLM sub-agents.
- [COMMAND_EXECUTION]: The skill utilizes terminal commands (primarily
ghCLI) to perform repository management tasks. - The design includes a mandatory "Phase 3: Execution (user-gated)" step which prevents the agent from performing destructive actions without explicit human approval of the staged plan.
- Pitfall T3 (SKILL.md) demonstrates awareness of shell execution risks, specifically mentioning the handling of multi-paragraph bodies to avoid silent failures during terminal invocation.
Audit Metadata