Omni Research

• Outcome: Review
• Latest audit: May 28, 2026 · 9:55 AM UTC
• Version: 1.0.0

Overview

This research skill does what it claims in broad terms, but it under-discloses that browser-session content can be sent to a configured API/proxy despite advertising zero API keys.

Review before installing. Use this only if you are comfortable letting it control a CDP-enabled browser profile that may already be logged into AI services, submit your prompts through those accounts, read rendered responses, and send collected text to the configured cliproxy endpoint for synthesis. Prefer a dedicated browser profile with only the needed accounts, keep CDP bound to localhost, and inspect ~/.config/omni-research/config.json before running.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises browser-based research but the metadata does not declare the powerful capabilities it relies on, including network access and execution of Python tooling. Undeclared capabilities reduce user and platform visibility into what the skill can actually do, which is especially risky here because CDP-based browser control can act through authenticated sessions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documentation claims 'zero API keys' and browser-based use of existing subscriptions, but it also documents an API-backed source and a synthesis proxy with configurable credentials. This mismatch can mislead users into routing sensitive prompts and extracted responses to external or local proxy infrastructure they did not expect, increasing the chance of data leakage or unsafe trust assumptions.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest and top-level description emphasize browser-only research via existing subscriptions, yet the same file exposes API-based operation using external endpoint and key configuration. That discrepancy is security-significant because users may approve the skill under a narrower trust model than the one it actually supports.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The skill advertises that it only uses the user's logged-in browser sessions and needs no API keys, but it also sends requests to an external proxy using an embedded bearer key. This is a trust-boundary violation: users may disclose sensitive research queries believing all processing stays within their browser subscriptions, while the code silently routes data to a third-party service.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The 'No API keys needed' claim is misleading because the implementation includes and uses a built-in proxy API key. Even if the key is intended for convenience, the mismatch can cause users to unknowingly transmit data to an external provider under false assumptions about how the tool operates.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Connecting to a browser over CDP gives broad control over tabs and access to already-authenticated web sessions, which can allow actions and data extraction far beyond a normal web request. Failing to warn users about this is dangerous in this skill's context because it targets premium AI services where account access, conversation history, and potentially sensitive prompts are exposed through the live browser session.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The example configuration includes an API key field without guidance on secure storage, scope, or rotation. Even though this is documentation-level, normalizing plaintext secret placement in a config file can lead to accidental disclosure through backups, logs, screenshots, or weak filesystem permissions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This code opens browser tabs, injects text into active pages, submits input, and closes tabs through the user's live Chrome DevTools session without any built-in consent, disclosure, or scope restriction. In the context of a research skill that uses the user's existing logged-in browser sessions, this creates a meaningful risk of covert actions on authenticated websites and makes unintended account interaction or data exposure possible.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The eval_js method executes arbitrary JavaScript in the context of a user-controlled browser tab and returns page-derived data, with no visible warning, sandboxing, or validation of what expressions may run. Because CDP Runtime.evaluate executes with the privileges of the loaded page, a malicious or overly broad caller could inspect sensitive DOM content, extract session-accessible page data, or trigger unintended in-page actions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This implementation directly connects to a locally running browser's CDP endpoint, which effectively grants powerful control over the user's browser state, tabs, and page contexts. In a skill explicitly designed to use the user's existing subscriptions and sessions, that level of access is especially dangerous because it can interact with authenticated services and read rendered content without any built-in privacy notice or access boundary.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The synthesis step sends the user's original query plus aggregated content from multiple sources to an external API service, which may include sensitive research topics, proprietary text, or personal data extracted from logged-in sessions. Because this transfer is not clearly surfaced to the user, it creates a significant privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill connects to the user's running browser via CDP and operates within logged-in sessions, which can access private account context and potentially sensitive content. While CDP use is core to the skill's function, the lack of an explicit privacy warning and consent flow makes the behavior riskier because users may not understand the level of access being granted.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.27
websockets>=12.0

• Confidence: 94% confidence
• Finding: httpx>=0.27

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.27
websockets>=12.0

• Confidence: 94% confidence
• Finding: websockets>=12.0

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.