ClawHub
Back to skill

Security audit

Omi Me

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plausible Omi.me integration, but its shell scripts handle API tokens and request destinations unsafely enough that users should review it before installing.

Install only if you are comfortable reviewing or fixing the shell scripts first. At minimum, replace API_URL with OMI_API_URL, avoid printing the token, set ~/.config/omi-me to 700 and the token file to 600 on every write path, and treat delete/sync commands as sensitive operations over your Omi.me memories, tasks, and conversations.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/omi-cli.sh:5
Finding

Bearer Token Disclosure Through API Endpoint Variable Confusion

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/setup.sh:12
Finding

Environment-Sourced API Token May Be Stored with World-Readable Permissions

Content
View full analysis
"$TOKEN_FILE" fi ``` ### Technical Analysis The automated setup path writes `OMI_API_TOKEN` into `~/.config/omi-me/token` without setting restrictive permissions on either the directory or the new file. File creation permissions are determined by the process umask. With a common umask of `022`, shell redirection creates the token file with permissions equivalent to `0644`, allowing other local users to read it when parent-directory traversal permissions permit access. The interactive token manager applies `chmod 600`, but the environment-import path in `setup.sh` omits that protection. The configuration directory is also created without an explicit `0700` mode. ### Attack Path 1. The victim runs `scripts/setup.sh` with `OMI_API_TOKEN` present in the environment. 2. No token file currently exists. 3. The setup script creates the file through shell redirection: ```bash echo "$OMI_API_TOKEN" > "$TOKEN_FILE" ``` 4. Under a permissive umask, the resulting file may be readable by other local accounts. 5. A local attacker reads: ```bash cat /home/victim/.config/omi-me/token ``` 6. The attacker uses the recovered token against the Omi API. This attack requires local filesystem access and sufficient permission to traverse the victim's home and configuration directories. ### Impact Assessment A local attacker may obtain the victim's Omi developer token and inherit all remote permissions associated with it. This can expose private memories, tasks, and conversations and may allow unauthorized creation, modification, o ...[truncated 236 chars]
Remediation
View remediation
"$TOKEN_FILE" chmod 600 "$TOKEN_FILE" ``` - Prefer an atomic installation operation where supported: ```bash printf '%s\n' "$OMI_API_TOKEN" | install -m 600 /dev/stdin "$TOKEN_FILE" ``` - Verify and repair permissions even when the token file already exists. - Reject symbolic links before writing the token, or create the file atomically with no-follow semantics. - Document the required `0700` directory and `0600` file permissions. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/omi-cli.sh:83
Finding

Jq Program Injection Through Search Queries

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/omi-cli.sh:65
Finding

Unsafe JSON Construction Allows Request-Body Injection

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The documentation and detected behavior are inconsistent, especially around credential-file access and additional operations like search and message posting. When a skill's declared purpose does not fully describe its actual capabilities, users and policy engines may underestimate what data it can access or modify.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documentation and detected behavior are inconsistent, especially around credential-file access and additional operations like search and message posting. When a skill's declared purpose does not fully describe its actual capabilities, users and policy engines may underestimate what data it can access or modify.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill documents shell-based setup and operational commands but does not declare any explicit tool scope or permissions. In an agent environment, undeclared shell capability increases the chance that the skill can perform filesystem changes, token handling, and network actions without clear user or platform review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill intentionally persists authentication material and command symlinks under the user's home directory, creating durable state beyond a single session. Persistence is expected for integrations, but it still expands the blast radius if the host or account is later compromised.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

text

The setup script will:
1. Create config directory `~/.config/omi-me/`
2. Guide you to configure your API token
3. Create symlinks for `omi` and `omi-token` commands

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Save your API token

echo "omi_dev_your_token_here" > ~/.config/omi-me/token chmod 600 ~/.config/omi-me/token

text

### Get API Token

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Documenting a command that prints the current API token encourages direct secret disclosure to terminal history, logs, screenshots, or agent outputs. In an agent setting, a tool that emits raw credentials can easily leak them across conversation context or telemetry.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation includes memory deletion commands without warning that the operation is destructive and may be irreversible. Because this skill manages user memories, accidental invocation could cause permanent loss of high-value personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Task deletion is presented as a normal command with no caution about irreversible removal. This can lead to accidental loss of action items or workflow state, especially when operated by an autonomous agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Conversation deletion is sensitive because it can erase communication history and context, yet the documentation gives no warning. In collaborative or memory-centric systems, such loss may be permanent and materially harmful.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Sync commands transfer memories, tasks, and conversations to or from a remote service, but the documentation omits privacy and data-handling warnings. Users may not realize that sensitive personal or organizational content is being transmitted and potentially persisted externally.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

omi memories list

text

**Create a memory:**
```bash
omi memories create "Caio prefers working in English" --type preference

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/omi-cli.sh (reported line 7)May include surrounding context.

sh
# Load environment variables from default locations
export OMI_API_TOKEN="${OMI_API_TOKEN:-$(cat ~/.config/omi-me/token 2>/dev/null)}"
export OMI_API_URL="${OMI_API_URL:-https://api.omi.me/v1/dev}"

if [ -z "$OMI_API_TOKEN" ]; then
    echo "Error: OMI_API_TOKEN not set."

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/omi-cli.sh (reported line 368)May include surrounding context.

sh
# Load environment variables from default locations
export OMI_API_TOKEN="${OMI_API_TOKEN:-$(cat ~/.config/omi-me/token 2>/dev/null)}"
export OMI_API_URL="${OMI_API_URL:-https://api.omi.me/v1/dev}"

if [ -z "$OMI_API_TOKEN" ]; then
    echo "Error: OMI_API_TOKEN not set."

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/omi-token.sh (reported line 39)May include surrounding context.

sh
# Load environment variables from default locations
export OMI_API_TOKEN="${OMI_API_TOKEN:-$(cat ~/.config/omi-me/token 2>/dev/null)}"
export OMI_API_URL="${OMI_API_URL:-https://api.omi.me/v1/dev}"

if [ -z "$OMI_API_TOKEN" ]; then
    echo "Error: OMI_API_TOKEN not set."

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/omi-token.sh (reported line 44)May include surrounding context.

sh
# Load environment variables from default locations
export OMI_API_TOKEN="${OMI_API_TOKEN:-$(cat ~/.config/omi-me/token 2>/dev/null)}"
export OMI_API_URL="${OMI_API_URL:-https://api.omi.me/v1/dev}"

if [ -z "$OMI_API_TOKEN" ]; then
    echo "Error: OMI_API_TOKEN not set."

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script documents and exports OMI_API_URL, but the actual HTTP requests use API_URL instead. This mismatch can silently send authenticated requests to an unintended endpoint if API_URL is set in the environment, or fail unpredictably while giving users a false sense of control over where sensitive data is sent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This function transmits user data and a bearer token to an external service via curl. In this skill context that behavior is expected, but it becomes security-relevant because the destination URL handling is flawed, so the token and memory/task/conversation contents could be sent to an attacker-controlled endpoint if API_URL is injected.

Content

Scanner excerpt · scripts/omi-cli.sh (reported line 23)May include surrounding context.

sh
local endpoint="$2"
    local data="$3"
    
    curl -s -X "$method" \
        -H "Authorization: Bearer $OMI_API_TOKEN" \
        -H "Content-Type: application/json" \
        "${API_URL}/$endpoint" \

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/omi-cli.sh (reported line 337)May include surrounding context.

sh
echo "  🧠 Memories:"
        echo "    omi memories list"
        echo "    omi memories get <id>"
        echo "    omi memories create \"content\" [--type <type>]"
        echo "    omi memories update <id> \"new content\""
        echo "    omi memories delete <id>"
        echo "    omi memories search \"query\""

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The get command prints the raw API token directly to stdout, which can leak credentials into terminal scrollback, shell history via command substitution, logs, or calling processes. A token-management helper for an integration does not need to expose the secret in plaintext to function, so this creates unnecessary credential disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Exposing the stored API token in plaintext without any warning makes accidental disclosure much more likely during normal use. Any local user, wrapper script, plugin, or log collector that captures stdout can obtain a bearer token and use it to access the user's Omi.me data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script stores the API token unencrypted on disk in a predictable location under the user's home directory. Although chmod 600 limits file access, plaintext storage still exposes the token to local compromise, backups, malware running as the user, or accidental disclosure, and the script does not warn the user about this tradeoff.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/omi-token.sh (reported line 68)May include surrounding context.

sh
fi
        
        echo "$TOKEN" > "$TOKEN_FILE"
        chmod 600 "$TOKEN_FILE"
        echo "✓ Token saved to $TOKEN_FILE"
        echo ""
        echo "Test your connection with: omi-token.sh test"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 53)May include surrounding context.

sh
# Check dependencies
if ! command -v jq &> /dev/null; then
    echo "⚠️  jq is not installed. Install with: sudo apt install jq"
fi

# Create _meta.json for OpenClaw skill registration

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The manifest describes an Omi.me integration for memories, tasks, conversations, and sync. Creating system-wide symlinks in /usr/local/bin is not part of that business purpose; it is an installation-side capability that modifies the host environment outside the skill's own config area.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.