omc-doctor

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to inspect and manage the installation environment.
  • Evidence includes the use of rm -rf and rm to delete legacy directories (agents/, commands/, skills/) and hook scripts in the ~/.claude directory during the auto-fix phase.
  • It uses ls, grep, and find to diagnose the presence of markers and legacy scripts.
  • [DYNAMIC_EXECUTION]: The skill uses node -e to run inline JavaScript for advanced file system operations.
  • These scripts perform version comparisons using localeCompare, handle directory traversal via readdirSync, and perform recursive deletions of the plugin cache with rmSync.
  • The logic is used to calculate version drift and clean up stale cache entries.
  • [EXTERNAL_DOWNLOADS]: The skill fetches updated configuration from the author's official GitHub repository.
  • It uses WebFetch to retrieve the latest CLAUDE.md from https://raw.githubusercontent.com/Yeachan-Heo/oh-my-claudecode/main/docs/CLAUDE.md.
  • It queries the NPM registry via npm view oh-my-claude-sisyphus version to check for available updates.
  • [INDIRECT_PROMPT_INJECTION]: The skill parses content from user-editable files to drive its diagnostic logic.
  • Ingestion points: Reads content from CLAUDE.md and companion files like CLAUDE-omc.md.
  • Boundary markers: No explicit boundary markers or 'ignore' instructions are used when reading these files.
  • Capability inventory: The skill has high-authority capabilities including file deletion (rm), remote fetching (WebFetch), and dynamic script execution (node -e).
  • Sanitization: The skill uses regex patterns (e.g., /<!--\s*OMC:VERSION:([^\s]+)\s*-->/i) to extract specific markers, which limits the risk of processing arbitrary instructions from the file body.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 12:34 PM
Security Audit — agent-trust-hub — omc-doctor