Agent skill · Audited from source
Ops Comms
skill · Lifecycle-Innovations-Limited/claude-opsMIT licenceAudited 21 Oct 2026 · source 90a91797a66f
Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 90a91797a66f and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 3 findings, 1 critical or high. What it does: OPS on-demand: This skill should be used when the user asks to "send a message"...
Cite
Cite this page
ModelsAtlas. “Ops Comms (Lifecycle-Innovations-Limited/claude-ops)”. Retrieved 21 Oct 2026. https://modelsatlas.com/skills/lifecycle-innovations-limited/ops-comms
Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 1 critical or high finding, starting with “Prompt injection” in SKILL.md:369. Do not install it without reading them.
Trust audit
Audit 0.4.1 · source read 21 Oct 2026
BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 721 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | FAIL | 3 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: critical finding, no behavioural pass, undeclared transfer.
Findings (3)
CRITICALPrompt injectionprompt.transfer_instruction · SKILL.md:369
${CLAUDE_PLUGIN_ROOT}/bin/ops-discord send "https://discord.com/api/webhooks/<ID>/<TOKEN>" "<message>" --json- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
MEDIUMPrivilege escalation / persistencereview.unsafe_action · SKILL.md
launchctl kickstart -k gui/$UID/com.${USER}.whatsapp-bridge- Why
- The skill auto-restarts a system daemon (launchctl kickstart) without the user's consent, a privileged persistent action.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
MEDIUMPrivilege escalation / persistencereview.unsafe_action · SKILL.md
If not running, restart: `launchctl kickstart -k gui/$(id -u)/com.${USER}.whatsapp-bridge` and wait 5s- Why
- Directs the agent to restart a privileged launchd service as a pre-flight step without asking the user.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
Audit 0.4.1 · source sha 90a91797a66f · 21 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- PublisherLifecycle-Innovations-Limited GitHub organizationOwner of the repository this skill is read from
- Source folderLifecycle-Innovations-Limited/claude-ops/claude-ops/skills/ops-commsThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict90a91797a66fA new audit runs when the source changes
- Repository statusNot archivedPushed today
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: OPS on-demand: This skill should be used when the user asks to "send a message"...
---
name: ops-comms
description: "OPS on-demand: This skill should be used when the user asks to \"send a message\"..."
argument-hint: '[channel] | send [message] to [contact] | read [channel] | notion [search query]'
allowed-tools:
- Bash
- Read
- Grep
- Glob
- Skill
- AskUserQuestion
- mcp__claude_ai_Gmail__search_threads
- mcp__claude_ai_Gmail__get_thread
- mcp__claude_ai_Gmail__create_draft
- mcp__claude_ai_Slack__slack_send_message
- mcp__claude_ai_Slack__slack_read_channel
- mcp__claude_ai_Slack__slack_search_users
- mcp__claude_ai_Slack__slack_search_public_and_private
- mcp__claude_ops_telegram__send_message
- mcp__claude_ops_telegram__get_updates
- mcp__claude_ops_telegram__list_chats
- mcp__claude_ai_Notion__notion-search
- mcp__claude_ai_Notion__notion-fetch
- mcp__claude_ai_Notion__notion-get-comments
- mcp__claude_ai_Notion__notion-create-comment
- mcp__claude_ai_Notion__notion-update-page
- mcp__claude_ai_Notion__notion-create-pages
effort: medium
maxTurns: 40
context: fork
---
# OPS ► COMMS
Load `ops-rules` before acting. Public repo (no personal data). Outbound: one draft → one approval → one send. If `AskUserQuestion` / `Workflow` are missing, follow Rule 10 in `ops-rules` (Hermes: numbered options / two-turn Telegram card; `delegate_task`).
## Runtime Context
Before executing, load available context:
1. **Daemon health**: Read `${CLAUDE_PLUGIN_DATA_DIR:-$HOME/.claude/plugins/data/ops-ops-marketplace}/daemon-health.json`
- Check bridge liveness before any WhatsApp operation: `lsof -i :8080 | grep LISTEN`
- If bridge not running, prompt user to restart: `launchctl kickstart -k gui/$UID/com.${USER}.whatsapp-bridge`
2. **Ops memories**: Before drafting any message, check `${CLAUDE_PLUGIN_DATA_DIR}/memories/`:
- `contact_*.md` — load profile for the recipient
- `preferences.md` — match user's communication style, language, and tone
- `donts.md` — restrictions that must not appear in any draft
3. **Preferences**: Read `${CLAUDE_PLUGIN_DATA_DIR}/preferences.json` for `default_channels` to determine which channel to prefer when multiple are available for a contact.
## Routing table
| Pattern | Action |
| ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `whatsapp` | Show WhatsApp recent chats — offer to read or send |
| `email` | Show recent email threads via Gmail MCP |
| `slack` | Show recent Slack activity |
| `telegram` | Show Telegram recent chats |
| `discord` | Show recent Discord channel activity (via bin/ops-discord) |
| `notion` | Search Notion workspace — pages, comments, tasks |
| `voice` | Voice / phone / video — routes to `/ops:ops-voice` (bin/ops-voice) |
| `call * ` | Native Phone.app call via `bin/ops-voice phone` |
| `facetime *` | FaceTime audio/video via `bin/ops-voice facetime` |
| `zoom` | Start an instant Zoom meeting via `bin/ops-voice zoom start` |
| `send * to *` | Parse message and contact, determine best channel, send |
| `read *` | Read the specified channel or contact's messages |
| `home alarm` | Pipe a Homey alarm event as a WhatsApp/Telegram alert — delegates to `/ops:ops-home alarm --notify` (only if `home_automation` is configured in `$PREFS_PATH`) |
| (empty) | Show channel picker menu |
Natural-language parsing:
- `send "deploy done" to #general on discord` → `bin/ops-discord send general "deploy done"`.
- `call <contact>` / `dial <contact>` / `phone <contact>` → resolve number, then `bin/ops-voice phone <E.164>`.
- `facetime <contact>` (with optional `audio`) → `bin/ops-voice facetime <handle> [--audio]`.
- `start a zoom` / `new zoom meeting` → `bin/ops-voice zoom start`.
- `join zoom <ID>` → `bin/ops-voice zoom join <ID>`.
- `text <contact> "<body>"` / `sms <contact> "<body>"` → `bin/ops-voice twilio-sms <to> $TWILIO_FROM_NUMBER "<body>"` (guarded by per-message approval).
---
## Send flow: `send [message] to [contact]`
1. Parse contact name and message from `$ARGUMENTS`.
2. Determine channel by contact lookup:
- Check WhatsApp: `mcp__whatsapp__search_contacts {query: "[contact]"}` 2>/dev/null
- Check Slack: `mcp__claude_ai_Slack__slack_search_users` with `query: "[contact]"`
- Check email: kExcerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 90a9179
git clone https://github.com/Lifecycle-Innovations-Limited/claude-ops git -C claude-ops checkout 90a91797a66f
The author documents no install command, so this uses the repository directly. Our verdict covers commit 90a91797a66f only.
Works in
The author has not said which agents this skill supports, and we have not tested it in any.
Audit history
Every audit, every source change
- ✕BLOCK D 69 / 100
first audit · source
90a91797a66f
Similar skills
All automation skills →Lifecycle-Innovations-Limited/claude-ops
This skill should be used when the user asks to "ops command center", "/ops:ops", or "run the business". Single discovery router for all business operations — communications, projects, infrastructure, revenue,…
Lifecycle-Innovations-Limited/claude-ops
OPS on-demand: This skill should be used when the user asks to "competitor intel", "what did they...
Lifecycle-Innovations-Limited/claude-ops
OPS on-demand: This skill should be used when the user asks to "which keys are set", "missing...
Lifecycle-Innovations-Limited/claude-ops
OPS on-demand: This skill should be used when the user asks to "deploy auto-fix", "failed deploy", or...
Lifecycle-Innovations-Limited/claude-ops
OPS on-demand: This skill should be used when the user asks to "control the desktop", "click on...
Lifecycle-Innovations-Limited/claude-ops
OPS on-demand: This skill should be used when the user asks to "plugin broken", "ops doctor", or...
Questions about Ops Comms
What does the Ops Comms skill do?
Is Ops Comms safe to install?
What can Ops Comms access on my machine?
How current is this page?
Sources
- github.com/Lifecycle-Innovations-Limited/claude-ops/tree/main/cl — the audited source at commit 90a91797a66f and every finding aboveObserved · 21 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the Ops Comms skill do?
- Is Ops Comms safe to install?
- What can Ops Comms access on my machine?