omh-autopilot

SUSPICIOUS: the skill's behavior mostly matches its stated purpose, but it is a high-agency autonomous orchestrator that can execute project commands, modify code through delegated subskills, and relies on external OMH/community skill trust not fully pinned in the skill itself. I found no clear credential theft or off-platform exfiltration, so this is not malware, but it carries medium security risk from autonomy and transitive trust.