The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses a high-risk pattern of downloading a shell script from an external URL (https://plannotator.ai/install.sh) and piping it directly to bash for execution. This occurs in both the master installation script and a helper script, allowing for unreviewed arbitrary code execution on the host system.
Evidence in scripts/install.sh: run "curl -fsSL https://plannotator.ai/install.sh | bash"
Evidence in scripts/ensure-plannotator.sh: if run "curl -fsSL https://plannotator.ai/install.sh | bash"; then
[EXTERNAL_DOWNLOADS]: The skill fetches code, binary tools, and configuration from external domains and GitHub repositories not included in the trusted vendor list, such as plannotator.ai and a repository belonging to an individual user.
Evidence in scripts/install.sh: Fetches from https://plannotator.ai/install.sh.
Evidence in scripts/setup-claude.sh: Recommends installation from https://github.com/Yeachan-Heo/oh-my-claudecode.
[PERSISTENCE]: Setup scripts modify the global settings and configuration files of several AI agent tools (Claude Code, Codex, Gemini, OpenCode) to install persistent hooks and customized developer instructions. These hooks ensure that custom scripts are executed automatically during the agent's operation.
Evidence in scripts/setup-codex.sh: Adds a notify hook to ~/.codex/config.toml that executes a generated local script ~/.codex/hooks/omu-notify.py.
Evidence in scripts/setup-gemini.sh: Configures an AfterAgent hook in ~/.gemini/settings.json that executes ~/.gemini/hooks/omu-plannotator.sh.
Evidence in scripts/setup-claude.sh: Modifies ~/.claude/settings.json to include a PermissionRequest hook for the plannotator command.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project files and implementation plans without evident sanitization, creating a surface for indirect prompt injection that could influence the agent's behavior.
Ingestion points: The skill reads content from .omu/long-term-plan.md, .omu/short-term-plan.md, .omu/progress.md, and plan.md in SKILL.md.
Capability inventory: The skill has broad shell execution and file system access capabilities across all phases (Plan, Execute, Verify, Cleanup).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands were found in the processing logic.
Sanitization: There is no evidence of filtering or escaping content read from the plan documents before it is used to guide the agent's next steps.

omu