skills/sehoon787/my-claude/hud/Gen Agent Trust Hub

hud

Fail

Audited by Gen Agent Trust Hub on Mar 24, 2026

Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to modify ~/.claude/settings.json, adding a statusLine configuration that executes a local script (omc-hud.mjs). This establishes a persistence mechanism where the script is executed by the host application during its normal operation.- [COMMAND_EXECUTION]: Employs multiple node -e shell commands to perform sensitive file system operations, including checking for file existence, creating directories, and cleaning up legacy files.- [COMMAND_EXECUTION]: Modifies file system permissions using fs.chmodSync to grant execution rights to the generated omc-hud.mjs script.- [REMOTE_CODE_EXECUTION]: The generated omc-hud.mjs script utilizes dynamic import() to execute code from computed paths within the plugin cache and potential development directories. This pattern allows for the execution of code from dynamically determined, unverified locations on the disk.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 24, 2026, 07:43 AM
Security Audit — agent-trust-hub — hud