refit
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources which could contain adversarial instructions targeting the agent's logic.
- Ingestion points: The skill reads instrumentation data from
.omc/logs/, plan notepads at.omc/notepads/*/issues.md, and session friction reports. - Boundary markers: No specific delimiters or warnings against following embedded instructions are mentioned for the ingested log and notepad content.
- Capability inventory: The skill possesses file-write capabilities across the repository (lint rules, CI jobs,
.mcp.json,scripts/) and shell execution capabilities to verify check failures. - Sanitization: There is no evidence of sanitization or filtering for the external content before it is processed or presented to the user.
- [COMMAND_EXECUTION]: The skill is instructed to execute shell commands to verify the integrity of newly created environment checks.
- Evidence: The instructions require the agent to "run it clean once, then demonstrate it failing on a deliberately introduced violation" for any newly installed deterministic check (e.g., lint rules or scripts).
Audit Metadata