OMNI — All-In-One Master Skill

• Outcome: Review
• Latest audit: May 28, 2026 · 3:26 PM UTC
• Version: 1.0.0

Overview

This all-purpose skill is not clearly malicious, but it gives agents very broad autonomy and persistent memory behavior that users should review before installing.

Install only if you want a very broad master routing skill and are comfortable reviewing its behavior. Before use, disable or tightly scope memory logging, require explicit confirmation for file writes, command execution, deployments, public posts/messages, camera or screen capture, credential use, and background automation, and prefer specialized skills for sensitive tasks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The document is framed as an advanced prompting reference, but it instructs the agent to read workspace files, run code, inspect recent commands, and deploy projects. That expands the skill from prompt interpretation into operational autonomy, which can cause unintended code execution, privacy exposure, or system changes when acting on vague user input.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The prompt repair examples normalize taking deployment and system actions as part of filling in missing context. This is dangerous because it encourages the model to assume targets and execute impactful operations without validating environment, authorization, or user intent.

Vague Triggers

High

• Confidence: 90% confidence
• Finding: The activation criteria are extremely broad ('do everything', cross-domain, or when routing is unclear), which can cause the skill to intercept many normal requests and bypass more specialized, safer skills. In a skill-routing system, overbroad matching increases the chance of misrouting sensitive tasks into a powerful general-purpose workflow with wider tool access and less predictable behavior.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: Many routing keywords are everyday words like 'think,' 'write,' 'project,' 'system,' and 'research,' so domain activation is ambiguous and collision-prone. This can route tasks into unintended capability areas, potentially invoking broader tooling or instructions than the user expected, especially for sensitive domains like security, system administration, or communications.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The brain protocol instructs persistent logging to memory files without any notice, consent, retention limit, or sensitivity filter. That creates a real privacy and security risk because user prompts, errors, decisions, and potentially secrets from sensitive tasks may be stored on disk and later exposed to other tools, users, or sessions.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The opening claim to transform any input, no matter how vague or incomplete, encourages broad activation on underspecified requests. In an omni skill with many powerful capabilities, this increases the chance of misrouting, overreach, and action on requests the user did not clearly authorize.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The guidance to infer intent rather than ask what the user means biases the agent toward acting on ambiguous inputs. In a broad master skill context, mistaken inference can lead to wrong-domain actions, data access, or execution with insufficient user direction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: These instructions describe reading workspace code, running it, and inspecting recent context without any warning about privacy, side effects, or execution safety. Users may not realize that a vague request could trigger access to sensitive files or active code execution.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The deployment repair example implicitly proceeds with deployment and even assumes a local target without warning about system changes or validating destination. That can normalize unauthorized or mistaken deployments and conceal the operational significance of the action.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The guidance recommends broad trigger mechanisms like system events, agent turns, and heartbeat checks without defining authorization, scope boundaries, or safe-use constraints. In an all-in-one automation skill, this can enable overbroad or unintended task execution, especially when combined with shell execution and long-running background processes described elsewhere in the file.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This section explicitly directs the agent to log key decisions, files modified, problems encountered, user preferences, and commands across every session without any consent, minimization, retention, or redaction controls. In an omni skill spanning many domains, those logs can easily capture sensitive personal, business, or security-relevant data and make it persist beyond the immediate task.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The adaptive learning rules mandate automatic storage of corrections, feature requests, runtime errors, and user-provided knowledge into persistent memory files. That creates undisclosed collection of user data and metadata, and runtime/error logs often include prompts, file paths, tokens, stack traces, or business context that should not be retained by default.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guidance explicitly recommends autonomous terminal coding via `kilo run --auto "task"` without any caution about reviewing planned actions, limiting scope, or warning that code, files, dependencies, and git state may be modified. In an omnibus skill that users may invoke for broad tasks, this increases the chance that an agent will perform repository-changing or system-affecting actions implicitly, making unintended modifications more likely.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file encourages tracking and integrating sensitive health data such as symptoms, medications, heart rate, blood pressure, and wearable information, but it provides no warning about privacy, consent, storage, or regulatory sensitivity. In an omni skill that may connect to many tools and services, this omission increases the chance that highly sensitive personal health information is collected, shared, or retained insecurely.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The file explicitly lists screen capture and camera-frame tools that can collect privacy-sensitive data from web pages, desktop UIs, and network cameras, but it provides no warning, consent requirement, or usage boundary. In an omnibus skill that routes many kinds of user requests, this omission makes it easier for an agent to capture sensitive on-screen information or camera feeds without adequate user awareness or authorization checks.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The instruction to log decisions, errors, and patterns to `memory/*.json` broadly encourages retention of task-derived content, which may include credentials, personal data, internal URLs, or confidential business information. Persistent local memory increases blast radius because sensitive inputs can survive beyond the session and be unintentionally reused or disclosed.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The execution protocol mandates routine recording of reusable patterns and daily logs with no privacy scoping, which normalizes indiscriminate retention across all tasks. In an omni skill handling security, finance, messaging, and documents, that context makes the issue more dangerous because the skill is likely to process highly sensitive material across multiple domains.

Ssd 3

Low

• Confidence: 78% confidence
• Finding: The instruction to log user preferences for future sessions introduces persistent retention behavior without describing consent, limits, or what data may be stored. This creates privacy and compliance risk, especially if preferences include sensitive workflow, project, or personal information.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: The instruction to 'remember everything' and log decisions, errors, patterns, and context encourages indiscriminate retention of conversational and operational context. In a general-purpose master skill, that broad memory mandate increases the chance of storing confidential user inputs and later surfacing them in unrelated contexts, creating a data leakage risk.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The escalation ladder normalizes asking the user for credentials or permissions as a routine troubleshooting step, without safeguards for secure collection, least privilege, or alternatives. In a broad omni skill, this can pressure users to disclose secrets directly into chat or logs, where they may be retained and exposed later.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The memory architecture explicitly creates persistent stores for mistakes, patterns, decisions, heartbeat state, and daily activity logs, and the logging rules include user preferences and full error context. Such durable cross-session storage materially increases leakage risk because sensitive data can be captured in rich operational logs and later reused or exposed outside the original context.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: These rules direct the agent to persist user corrections, feature requests, and knowledge gaps into memory files as part of normal operation. That effectively turns ordinary interaction into long-term profile building without notice, and the accumulated memory may contain sensitive preferences, proprietary facts, or identifying details.

Static analysis

No suspicious patterns detected.