omx

SUSPICIOUS. The skill’s capabilities generally match its orchestration purpose and install path is reasonably consistent, but it meaningfully increases operational risk through autonomous execution, approval-bypass modes, repository instruction injection, and executable hook plugins. No clear credential harvesting or off-platform exfiltration is shown, so this is not confirmed malware.