Wit.ai

• Outcome: Pass
• Latest audit: Jun 4, 2026 at 11:26 AM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed Wit.ai connector wrapper with credentialed read, write, and delete capabilities that are scoped to Wit.ai and include confirmation guidance for changes.

Install only if you intend to let your agent access your Wit.ai account through OOMOL. Review payloads before approving create, update, or delete actions, especially deletion of utterances, because those operations can change training data in your Wit.ai app.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The skill description says to use this skill for ANY Wit.ai request, which is overly broad and can cause the agent to invoke it automatically for a wide range of Wit.ai-related tasks without sufficient task-specific gating. In context, this increases the chance of unintended use of write or delete-capable actions, especially because the skill exposes both read-only and state-changing operations through one entry point.

VirusTotal

62/62 vendors flagged this skill as clean.