Security audit

OMC/OMX 编码任务编排器

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed background coding-task orchestrator, but it gives downstream agents broad local authority by default and uses activation and cleanup rules that need careful review.

Install only if you intentionally want Claude/Codex jobs to run in the background against local projects. Use explicit commands and trusted working directories, avoid placing secrets or private customer data in prompts or specs, monitor task folders and PIDs, and prefer sandboxed or per-task approval-based execution where possible.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill auto-loads on broad OMC/OMX keyword matches, so ordinary discussion mentioning those tools may unintentionally trigger a high-privilege orchestration workflow. In this context, accidental activation is dangerous because the skill is designed to spawn background processes, read/write files, and potentially launch unsandboxed external agents.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list includes generic phrases like '派任务' and '后台编码', which can easily appear in benign conversation and unintentionally invoke the skill. Because the skill can dispatch autonomous code agents and persist artifacts to disk, false activations have meaningful security and operational consequences.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill instructs operators to always run OMX with '--dangerously-bypass-approvals-and-sandbox', explicitly disabling approvals and sandbox protections. In a tool whose purpose is to hand arbitrary coding tasks to an external agent, this substantially raises the blast radius: a mistaken, malicious, or prompt-injected task could modify local files, run commands, or exfiltrate accessible data without meaningful containment.

Missing User Warnings

High

Confidence: 86% confidence
Finding: The documented cron job kills tmux sessions matching a broad name pattern every hour, which can terminate still-running detached OMX tasks or unrelated sessions that happen to match. In an orchestration skill that manages asynchronous background jobs, this increases the chance of integrity and availability loss through unintended process termination.

Static analysis

No suspicious patterns detected.