skill
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCECREDENTIALS_UNSAFEDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Several utility and diagnostic skills (e.g.,
omc-doctor,omc-setup) fetch resources, such as theCLAUDE.mdconfiguration file, from the project's official repository atgithub.com/Yeachan-Heo/oh-my-claudecodeto ensure local configurations are synchronized with the latest version. - [COMMAND_EXECUTION]: The framework uses the agent's shell access to perform Git operations, manage Docker containers, and handle project state through various CLI tools. These actions are standard for an automated development assistant and are triggered by user-invoked commands.
- [CREDENTIALS_UNSAFE]: To enable real-time alerts, the
configure-notificationsskill interactively collects Telegram bot tokens, Discord webhook URLs, and Slack webhook URLs. These are stored locally in the agent's designated configuration folder (~/.gemini/antigravity/.omc-config.json) to enable the notification feature. The skill includes a test feature that usescurlto verify these credentials with their respective official service providers. - [PERSISTENCE]: The
hudskill establishes a persistent Heads-Up Display by modifying the agent'ssettings.jsonto include astatusLinecommand and by creating a local executable loader script. This allows the tool's HUD to persist across different working sessions. - [DYNAMIC_EXECUTION]: The tool includes a setup wizard for MCP servers that utilizes
npxto install and run tools from the npm registry. Additionally, the HUD status line uses a dynamic import pattern to load core plugin logic from local cache or developer directories.
Audit Metadata