oh-my-cli-autonomous-code-agent
Warn
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent or user to clone a codebase from a non-trusted repository (
github.com/qwen-code-dev-bot/oh-my-cli.git).\n- [REMOTE_CODE_EXECUTION]: The installation process involves runningnpm installandnpm run buildon the downloaded code, which can trigger the execution of arbitrary scripts defined in the package's configuration.\n- [COMMAND_EXECUTION]: The agent is explicitly configured with shell execution capabilities (execute_command). While the skill mentions approval gates, providing an AI with shell access to a local environment is a high-privilege operation.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to autonomously process and refactor codebases which may contain malicious instructions.\n - Ingestion points: The agent ingests untrusted data from the local project files using tools like
read_fileandlist_directory.\n - Boundary markers: The skill does not define specific delimiters or instructional barriers to prevent the agent from following instructions embedded within the files it reads.\n
- Capability inventory: The agent possesses highly impactful capabilities, including the ability to write files (
write_file) and execute arbitrary shell commands (execute_command).\n - Sanitization: No sanitization or validation logic is specified for the content retrieved from the file system before it is processed by the model.
Audit Metadata