macos-terminal-beautify

• Outcome: Pass
• Latest audit: May 29, 2026, 8:46 PM
• Version:
  1.0.0

Overview

This is a coherent macOS terminal customization skill with expected setup risks, not hidden or malicious behavior.

Install only if you want this macOS terminal setup. Review the Oh My Zsh installer before running it, back up ~/.zshrc, and run commands manually so you can inspect each change.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs users to execute a remote script directly via `curl | sh`, which bypasses review of the downloaded code and gives the remote source immediate execution in the user's shell context. Even if the upstream project is legitimate, this pattern creates supply-chain risk and makes compromise of the remote endpoint or repository immediately dangerous.

VirusTotal

64/64 vendors flagged this skill as clean.