ClawHub
Back to skill

Security audit

omz

Security checks across malware telemetry and agentic risk

Overview

This Oh My Zsh skill mostly does what it says, but it also tells the agent to upgrade the skill itself after normal use without explicit user approval.

Review this skill before installing. The zsh file and plugin-management behavior is expected, but only allow changes to .zshrc or $ZSH_CUSTOM after reviewing the exact diff. The main concern is the self-improvement instruction: do not let it run /skill-manager upgrade omz unless you explicitly asked to update the skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The skill directs the agent to perform a `/skill-manager upgrade omz` action after invocation based on conversation content, which is unrelated to the user’s immediate Oh My Zsh task and introduces an implicit self-modification path. Any instruction that causes the agent to alter its own capabilities or prompts without explicit user approval expands the attack surface and can be abused through prompt injection or crafted conversations.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
The skill explicitly instructs automatic self-modification via `/skill-manager upgrade omz` without warning, consent, or verification, creating a direct mechanism for unauthorized state changes. In the context of an agent skill, this is dangerous because a normal user interaction about zsh configuration could trigger persistent changes to the agent’s behavior beyond the requested task.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs direct creation or modification of `*.zsh` files under `$ZSH_CUSTOM`, which are automatically executed on shell startup, but it does not require an explicit warning or confirmation about persistence and code-execution effects. In a shell-management skill, this behavior is expected, but it still creates a real risk because generated content can persist across sessions and run implicitly every time the user opens a terminal.

Session Persistence

Medium
Category
Rogue Agent
Content
# Oh My Zsh Custom Script Authoring

Write `$ZSH_CUSTOM/*.zsh` files based on requirements.

## $ZSH_CUSTOM Path
Confidence
90% confidence
Finding
The skill explicitly directs writing persistent shell customization files in `$ZSH_CUSTOM`, causing changes to survive the current session and execute automatically in future shells. Although this is aligned with the skill's purpose, persistence in a shell startup path is security-relevant because it can be abused to establish durable command execution or alter user behavior invisibly over time.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.