omarchy-plugin-security
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The README provides instructions for installing the skill via
npx skills addand cloning from the vendor's GitHub repository (github.com/wbso-ai). It also suggests running a local security scanner by cloning the official Omarchy marketplace repository. These are documented installation and diagnostic procedures. - [COMMAND_EXECUTION]: The skill provides numerous
grepand shell command examples for auditing code, as well as a supervised command wrapper in Bash. These are intended for local use by the developer or agent during a security audit to identify common pitfalls like unpinned dependencies or insecure QML sinks. - [DYNAMIC_EXECUTION]: The Appendix includes Python and Bash scripts provided as secure templates for file handling and process supervision. These scripts demonstrate security best practices, such as descriptor-based I/O (
os.openwithO_NOFOLLOW), atomic writes, and output capping to prevent resource exhaustion. - [SAFE]: No malicious patterns, obfuscated payloads, or unauthorized data access attempts were found. The skill serves as a security knowledge base for developers working within the Omarchy ecosystem.
Audit Metadata