Yeachan-Heo/oh-my-claudecode hook server skill
workflow automation
Oh-my-claudecode (OMC) is a multi-agent orchestration framework for Claude Code that automates complex workflows through natural language commands. It provides in-session skills and terminal CLI tools to coordinate planning, execution, testing, and code review tasks without requiring users to learn Claude Code syntax.
Run /autopilot to automatically plan, build, and QA features end-to-end Use /team to spawn parallel Claude/Codex/Gemini workers for distributed code tasks Execute /deep-interview to clarify requirements before starting development Coordinate code review and testing with /ask and /ralph specialized advisors Install via Claude Code plugin marketplace or npm for CLI access 11 CRITICAL✓ 30 HIGH✓ 129 MEDIUM 15 LOW 1 INFO
✓ CRITICAL/HIGH reflect AI-verified findings (false positives excluded) · MEDIUM/LOW/INFO are unverified scanner output
AI-verified (CRITICAL/HIGH): 41 likely real (100%) 12 false positive — excluded from CRITICAL/HIGH count above
Findings by checker · 12 high-signal, 2 mostly false-positive (hidden by default)
CHK-125 9 findings 6 likely 3 false positive
33% FP CHK-129 8 findings 8 likely
0% FP CHK-081 7 findings 7 likely
0% FP CHK-099 6 findings 5 likely 1 false positive
17% FP CHK-035 4 findings 4 likely
0% FP CHK-008 2 findings 2 likely
0% FP CHK-089 1 finding 1 likely
0% FP CHK-001 1 finding 1 likely
0% FP CHK-073 1 finding 1 likely
0% FP CHK-083 1 finding 1 likely
0% FP CHK-066 1 finding 1 likely
0% FP CHK-074 1 finding 1 likely
0% FP ▼ Show 2 checkers that are mostly false positives (11 findings) 186 findings click to expand
CHK-081 Command injection risk — exec/execSync with string interpolation in scripts/context-guard-stop.mjs
scripts/context-guard-stop.mjs
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in scripts/cleanup-orphans.mjs
scripts/cleanup-orphans.mjs
AI: likely real confirmed ▼
CHK-035 [GHSA-w7jw-789q-3m8p] shell-quote — shell-quote quote() does not escape newlines in object .op values
AI: likely real confirmed ▼
CHK-035 [GHSA-5xrq-8626-4rwp] vitest — When Vitest UI server is listening, arbitrary file can be read and executed
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in benchmarks/run-all.ts
benchmarks/run-all.ts
AI: likely real confirmed ▼
CHK-089 --dangerously-skip-permissions in executable — all permission checks bypassed
bridge/runtime-cli.cjs
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in src/autoresearch/runtime.ts
src/autoresearch/runtime.ts
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in src/lib/release-generation.ts
src/lib/release-generation.ts
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in scripts/run-provider-advisor.js
scripts/run-provider-advisor.js
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in src/features/auto-update.ts
src/features/auto-update.ts
AI: likely real confirmed ▼
CHK-001 Wildcard PreToolUse hook — fires before EVERY tool call
hooks/hooks.json
AI: likely real likely ▼
CHK-073 Curl Pipe Bash Install detected in benchmark/Dockerfile
benchmark/Dockerfile
AI: likely real likely ▼
CHK-083 Potential path traversal — user-controlled path in file operation: bridge/gyoshu_bridge.py
bridge/gyoshu_bridge.py
AI: likely real likely ▼
CHK-099 Potential IDOR — 'task_id' accessed without ownership check
src/team/api-interop.ts
AI: likely real possible ▼
CHK-099 Potential IDOR — 'task_id' accessed without ownership check
bridge/runtime-cli.cjs
AI: likely real likely ▼
CHK-099 Potential IDOR — 'task_id' accessed without ownership check
bridge/team.js
AI: likely real likely ▼
CHK-099 Potential IDOR — 'task_id' accessed without ownership check
src/team/cli-worker-contract.ts
AI: likely real possible ▼
CHK-099 Potential IDOR — 'task_id' accessed without ownership check
src/cli/commands/team.ts
AI: likely real possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in scripts/context-guard-stop.mjs
scripts/context-guard-stop.mjs
AI: likely real likely ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in autoresearch/runtime.ts
src/autoresearch/runtime.ts
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in features/auto-update.ts
src/features/auto-update.ts
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in cli/tmux-utils.ts
src/cli/tmux-utils.ts
AI: likely real likely ▼
CHK-066 PermissionRequest hook configured — fires when Claude requests permissions
hooks/hooks.json
AI: likely real likely ▼
CHK-008 PostToolUse governance hook captures broad tool output
hooks/hooks.json
AI: likely real likely ▼
CHK-008 Stop governance hook captures broad tool output
hooks/hooks.json
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in scripts/cleanup-orphans.mjs
scripts/cleanup-orphans.mjs
AI: likely real likely ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in team/model-contract.ts
src/team/model-contract.ts
AI: likely real likely ▼
CHK-024 Filesystem traversal instruction in skill — read dotfiles
skills/project-session-manager/SKILL.md
AI: likely real likely ▼
CHK-024 Filesystem traversal instruction in skill — sensitive dotfile access
skills/ralplan/SKILL.md
AI: likely real likely ▼
CHK-024 Filesystem traversal instruction in skill — sensitive dotfile access
skills/autopilot/SKILL.md
AI: likely real likely ▼
CHK-074 Permission bypass referenced in documentation
SECURITY.md
AI: likely real likely ▼
CHK-035 [GHSA-88fw-hqm2-52qc] hono — hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
AI: likely real confirmed ▼
CHK-035 [GHSA-fx2h-pf6j-xcff] vite — vite: `server.fs.deny` bypass on Windows alternate paths
AI: likely real confirmed ▼
CHK-129 Sensitive field in return type/schema — token: str
src/openclaw/dedupe.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — Token: str
src/team/worker-bootstrap.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
src/team/runtime-v2.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
src/team/types.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — Token: str
src/lib/featured-contributors.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — Token: str
src/notifications/types.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
src/notifications/session-registry.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — Token: str
src/hud/usage-api.ts
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in scripts/build-mcp-server.mjs
scripts/build-mcp-server.mjs
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in scripts/plugin-setup.mjs
scripts/plugin-setup.mjs
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in scripts/plugin-setup.mjs
scripts/plugin-setup.mjs
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in scripts/pre-tool-enforcer.mjs
scripts/pre-tool-enforcer.mjs
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in scripts/release.ts
scripts/release.ts
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in scripts/build-bridge-entry.mjs
scripts/build-bridge-entry.mjs
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in scripts/audit-multirepo-e2e.mjs
scripts/audit-multirepo-e2e.mjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in shared/parser.ts
benchmarks/shared/parser.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in scoring/parser.ts
benchmarks/harsh-critic/scoring/parser.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in workflows/release.yml
.github/workflows/release.yml
possible ▼
CHK-125a fs.writeFile — unrestricted file write — no scope constraint in bridge/team.js
bridge/team.js
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in bridge/team.js
bridge/team.js
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in bridge/gyoshu_bridge.py
bridge/gyoshu_bridge.py
possible ▼
CHK-125a os.unlink() — file deletion — no scope constraint in bridge/gyoshu_bridge.py
bridge/gyoshu_bridge.py
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in agents/security-reviewer.md
agents/security-reviewer.md
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in benchmarks/run-all.ts
benchmarks/run-all.ts
possible ▼
CHK-125 child_process module — shell execution — no scope constraint in scripts/persistent-mode.cjs
scripts/persistent-mode.cjs
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in scripts/run-provider-advisor.js
scripts/run-provider-advisor.js
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in scripts/status.mjs
scripts/status.mjs
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in scripts/run.cjs
scripts/run.cjs
possible ▼
CHK-036 [GHSA-wwfh-h76j-fc44] hono 4.12.21 — see advisory: GHSA-wwfh-h76j-fc44
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in scripts/eval-autoresearch-json.mjs
scripts/eval-autoresearch-json.mjs
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in scripts/code-simplifier.mjs
scripts/code-simplifier.mjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in scripts/post-tool-verifier.mjs
scripts/post-tool-verifier.mjs
possible ▼
CHK-125b chown — ownership change — no scope constraint in scripts/post-tool-verifier.mjs
scripts/post-tool-verifier.mjs
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in scripts/eval-autoresearch-timed-json.mjs
scripts/eval-autoresearch-timed-json.mjs
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in hooks/post-tool-use.mjs
templates/hooks/post-tool-use.mjs
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in hooks/code-simplifier.mjs
templates/hooks/code-simplifier.mjs
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in project-session-manager/psm.sh
skills/project-session-manager/psm.sh
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in omc-doctor/SKILL.md
skills/omc-doctor/SKILL.md
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in phases/02-configure.md
skills/omc-setup/phases/02-configure.md
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in lib/memory-manager.ts
skills/writer-memory/lib/memory-manager.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in autoresearch/contracts.ts
src/autoresearch/contracts.ts
possible ▼
CHK-036 [GHSA-h67p-54hq-rp68] js-yaml 4.1.1 — see advisory: GHSA-h67p-54hq-rp68
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in providers/index.ts
src/providers/index.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in interop/omx-team-state.ts
src/interop/omx-team-state.ts
possible ▼
CHK-036 [GHSA-w7jw-789q-3m8p] shell-quote 1.8.3 — see advisory: GHSA-w7jw-789q-3m8p
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in planning/artifacts.ts
src/planning/artifacts.ts
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in utils/resolve-node.ts
src/utils/resolve-node.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in utils/omc-cli-rendering.ts
src/utils/omc-cli-rendering.ts
possible ▼
CHK-036 [GHSA-fx2h-pf6j-xcff] vite 7.3.3 — see advisory: GHSA-fx2h-pf6j-xcff
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in cli/autoresearch-setup-session.ts
src/cli/autoresearch-setup-session.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in cli/index.ts
src/cli/index.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in cli/autoresearch-intake.ts
src/cli/autoresearch-intake.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in team/runtime-owner-client.ts
src/team/runtime-owner-client.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in team/task-recovery-checkpoint.ts
src/team/task-recovery-checkpoint.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in team/cli-detection.ts
src/team/cli-detection.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in team/mcp-team-bridge.ts
src/team/mcp-team-bridge.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in team/worker-commit-cadence.ts
src/team/worker-commit-cadence.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in team/api-interop.ts
src/team/api-interop.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in team/team-ops.ts
src/team/team-ops.ts
possible ▼
CHK-125a fs.writeFile — unrestricted file write — no scope constraint in team/tmux-session.ts
src/team/tmux-session.ts
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in team/tmux-session.ts
src/team/tmux-session.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in team/monitor.ts
src/team/monitor.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in hooks/team-worker-hook.ts
src/hooks/team-worker-hook.ts
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in lib/featured-contributors.ts
src/lib/featured-contributors.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in lib/job-state-db.ts
src/lib/job-state-db.ts
possible ▼
CHK-125a fs.readFile — filesystem read access — no scope constraint in lib/atomic-write.ts
src/lib/atomic-write.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in lib/worktree-paths.ts
src/lib/worktree-paths.ts
possible ▼
▼ Show 12 false positives (6% of this view) Last scanned: Jul 12, 2026
More servers
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
obra/superpowers 85
Foundational skill pack by Jesse Vincent now in anthropics/claude-plugins-official. Includes ffuf web-fuzzing/pentest skill. Partial analysis done — full hook and plugin inspection pending. tier=T2
191k★
skypilot-org/skypilot 85
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
Significant-Gravitas/AutoGPT 85
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
186k★
Scan your entire org's MCP deployment
2,500+ repos pre-scored. 22% carry CRITICAL findings.