omc

SUSPICIOUS. The skill’s capabilities broadly match its orchestration purpose, and the install sources appear same-project and documented, so this is not confirmed malware. Risk is driven by transitive plugin installation from a personal GitHub publisher, autonomous persistent execution, and optional credential/data forwarding to notification services and extra AI CLIs.