omc-setup
Warn
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell scripts and Node.js one-liners that perform file system operations, including recursive directory removal (
f.rmSync) within plugin cache folders. - [COMMAND_EXECUTION]: Modifies global configuration files at
~/.claude/settings.jsonto inject environment variables and UI settings (HUD status line). - [COMMAND_EXECUTION]: Suggests the use of
sudofor global NPM package installation if standard permission levels fail, which is a high-risk security practice. - [REMOTE_CODE_EXECUTION]: Prompts the user to install a third-party global NPM package (
oh-my-claude-sisyphus) to provide CLI functionality. - [EXTERNAL_DOWNLOADS]: Fetches executable-ready markdown instructions (CLAUDE.md) from a public GitHub repository to configure agent behavior.
- [PROMPT_INJECTION]: Contains directives that instruct the agent to bypass summarization and immediately execute the provided workflow, ensuring strict adherence to the setup script.
- [COMMAND_EXECUTION]: Interacts with the GitHub CLI (
gh api) to check user starring status and potentially perform write actions on the user's behalf.
Audit Metadata