ohmg
Warn
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONMETADATA_POISONING
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the execution of
bunx oh-my-agandbunx oh-my-ag doctor.bunx(similar tonpx) downloads and executes packages from the npm registry at runtime. - Evidence:
bunx oh-my-ag,bunx oh-my-ag doctor,bunx oh-my-ag dashboardin SKILL.md. - [REMOTE_CODE_EXECUTION]: The use of
bunxfacilitates immediate execution of remote code. The packageoh-my-agis not from a trusted organization or well-known service, posing a risk of executing unverified code on the local system. - [METADATA_POISONING]: There is a discrepancy between the declared author of the skill ('akillness') and the source repository listed in the metadata ('first-fluke/oh-my-ag'). This inconsistency can lead to misattribution and complicates the verification of the tool's origin.
- Evidence:
source: first-fluke/oh-my-agin the YAML frontmatter of SKILL.md.
Audit Metadata