oh-my-cli-autonomous-code-agent

SUSPICIOUS: the skill's broad file/shell capabilities fit its stated purpose, but trust is weakened by a cross-publisher install chain and by forwarding API keys/prompts to user-configurable third-party OpenAI-compatible endpoints. No confirmed malware or hidden exfiltration is shown, yet the overall footprint is high-impact enough that this should be treated as medium risk rather than benign.