Oh-my-openagent

Configure and operate oh-my-openagent (OmO), the OpenCode plugin that adds multi-agent orchestration, skills, hooks, MCPs, and multi-provider model routing....

This skill appears coherent for configuring a local multi-agent plugin, but it enables powerful capabilities: shell execution, file read/write, background/continuous loops, and MCP servers that can be started with environment variables. Before installing or enabling it: (1) inspect the upstream repository and release artifacts on the listed homepage; (2) back up your OpenCode config and auth.json and inspect auth.json for sensitive tokens; (3) do not provide broad provider credentials unless you trust the code — prefer provider-specific, least-privilege keys; (4) restrict agent/tool permissions (disable bash/webfetch/skill_mcp or limit tools per-agent) and disable automatic background/continuation features until tested; (5) if possible, test in an isolated environment (VM/container) first. If you want, I can produce a checklist of specific config flags to change to minimize risk (e.g., disable background tasks, restrict tools for Sisyphus, refuse automatic MCP env interpolation).

Type: OpenClaw Skill Name: oh-my-openagent Version: 1.0.0 The skill bundle provides documentation and configuration for 'oh-my-openagent,' a multi-agent orchestration system. It describes a highly capable environment with access to over 40 tools, including shell execution (bash/interactive_bash), file system manipulation, and access to sensitive provider authentication tokens in '~/.local/share/opencode/auth.json'. While these risky capabilities are plausibly required for the stated purpose of a coding assistant, the broad permissions and the installation of external packages via 'bunx' (SKILL.md) warrant a suspicious classification according to the provided criteria, despite the lack of clear evidence of malicious intent or data exfiltration.