hud
Warn
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of
node -eone-liners to perform file system operations, including directory creation (mkdirSync), verification of existing files, and removal of legacy scripts (unlinkSync). - [COMMAND_EXECUTION]: It uses
chmodSyncto set executable permissions (0o755) on the newly created scriptomc-hud.mjs, which is a prerequisite for its execution by the host system. - [REMOTE_CODE_EXECUTION]: The skill establishes a persistence mechanism by instructing the agent to modify
~/.claude/settings.json. It adds astatusLinecommand that directs the host application to execute the generatedomc-hud.mjsscript during every session. - [REMOTE_CODE_EXECUTION]: The created
omc-hud.mjsscript utilizes dynamicimport()to load and execute JavaScript files from the plugin cache, development workspaces, or the NPM registry. This pattern allows the execution of code that is not contained within the skill itself and may be updated independently. - [EXTERNAL_DOWNLOADS]: The setup process relies on external components, specifically the
oh-my-claudecodeplugin, which must be installed from a remote source to provide the necessary logic for the HUD functionality.
Audit Metadata