The Agent Skills Directory

[COMMAND_EXECUTION]: The skill references the use of a local command-line tool omh for recording runtime telemetry. These commands (e.g., omh runtime record) are standard platform logging mechanisms for tracking skill execution status and do not appear to be malicious.
[INDIRECT_PROMPT_INJECTION]: The skill manages interactions with external SaaS providers (Jira, Slack, Discord, etc.), which creates an ingestion surface for untrusted data from provider responses. However, the skill explicitly mandates safety measures, including connector_confirmation_gate/v1 for any mutations and a clear prepared-vs-observed boundary to prevent the agent from acting on unverified instructions embedded in external data.
[REMOTE_CODE_EXECUTION]: No remote code execution patterns were found. The skill uses abstract connector definitions rather than direct network calls or script downloads.

omh-apps