hud

Warn

Audited by Gen Agent Trust Hub on Mar 13, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of node -e one-liners to perform file system operations, including directory creation (mkdirSync), verification of existing files, and removal of legacy scripts (unlinkSync).
  • [COMMAND_EXECUTION]: It uses chmodSync to set executable permissions (0o755) on the newly created script omc-hud.mjs, which is a prerequisite for its execution by the host system.
  • [REMOTE_CODE_EXECUTION]: The skill establishes a persistence mechanism by instructing the agent to modify ~/.claude/settings.json. It adds a statusLine command that directs the host application to execute the generated omc-hud.mjs script during every session.
  • [REMOTE_CODE_EXECUTION]: The created omc-hud.mjs script utilizes dynamic import() to load and execute JavaScript files from the plugin cache, development workspaces, or the NPM registry. This pattern allows the execution of code that is not contained within the skill itself and may be updated independently.
  • [EXTERNAL_DOWNLOADS]: The setup process relies on external components, specifically the oh-my-claudecode plugin, which must be installed from a remote source to provide the necessary logic for the HUD functionality.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 13, 2026, 04:54 AM