skills/akillness/oh-my-unity3d/ohmg/Gen Agent Trust Hub

ohmg

Warn

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONMETADATA_POISONING
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the execution of bunx oh-my-ag and bunx oh-my-ag doctor. bunx (similar to npx) downloads and executes packages from the npm registry at runtime.
  • Evidence: bunx oh-my-ag, bunx oh-my-ag doctor, bunx oh-my-ag dashboard in SKILL.md.
  • [REMOTE_CODE_EXECUTION]: The use of bunx facilitates immediate execution of remote code. The package oh-my-ag is not from a trusted organization or well-known service, posing a risk of executing unverified code on the local system.
  • [METADATA_POISONING]: There is a discrepancy between the declared author of the skill ('akillness') and the source repository listed in the metadata ('first-fluke/oh-my-ag'). This inconsistency can lead to misattribution and complicates the verification of the tool's origin.
  • Evidence: source: first-fluke/oh-my-ag in the YAML frontmatter of SKILL.md.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Nov 6, 2026, 09:09 AM