Omniscient

• Outcome: Review
• Latest audit: May 29, 2026 at 9:32 PM UTC
• Version:
  1.0.2

Overview

This skill openly provides broad system-control automation, but it also includes sensitive credential, camera, microphone, screen, network, and runtime installation capabilities that need review before use.

Install only if you intentionally want a powerful local Windows automation controller. Review commands before running them, avoid using it on sensitive screens or around private audio/video unless explicitly needed, do not expose live tokens or WiFi passwords in logs, and prefer a controlled virtual environment because it may install Python packages at runtime.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import pycaw
        return pycaw
    except ImportError:
        subprocess.check_call([sys.executable, "-m", "pip", "install", "pycaw>=2.2.7,<3", "-q"])
        import pycaw
        return pycaw

• Confidence: 87% confidence
• Finding: subprocess.check_call([sys.executable, "-m", "pip", "install", "pycaw>=2.2.7,<3", "-q"])

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import sounddevice as sd
        return sd
    except ImportError:
        subprocess.check_call([sys.executable, "-m", "pip", "install", "sounddevice>=0.5.0,<1", "-q"])
        import sounddevice as sd
        return sd

• Confidence: 87% confidence
• Finding: subprocess.check_call([sys.executable, "-m", "pip", "install", "sounddevice>=0.5.0,<1", "-q"])

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import psutil
        return psutil
    except ImportError:
        subprocess.check_call([sys.executable, "-m", "pip", "install", "psutil>=5.9.8,<7", "-q"])
        import psutil
        return psutil

• Confidence: 95% confidence
• Finding: subprocess.check_call([sys.executable, "-m", "pip", "install", "psutil>=5.9.8,<7", "-q"])

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return "", f"ERROR: Command blocked - contains '{blocked}'", -1

    try:
        result = subprocess.run(
            cmd, shell=True, capture_output=True, text=True,
            encoding="utf-8", errors="replace", timeout=timeout
        )

• Confidence: 96% confidence
• Finding: result = subprocess.run( cmd, shell=True, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import bleak
        return bleak
    except ImportError:
        subprocess.check_call([sys.executable, "-m", "pip", "install", "bleak>=0.22.0,<1", "-q"])
        import bleak
        return bleak

• Confidence: 90% confidence
• Finding: subprocess.check_call([sys.executable, "-m", "pip", "install", "bleak>=0.22.0,<1", "-q"])

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import cv2
        return cv2
    except ImportError:
        subprocess.check_call([sys.executable, "-m", "pip", "install", "opencv-python-headless>=4.9.0.80,<5", "-q"])
        import cv2
        return cv2

• Confidence: 91% confidence
• Finding: subprocess.check_call([sys.executable, "-m", "pip", "install", "opencv-python-headless>=4.9.0.80,<5", "-q"])

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # Use list-based invocation (no shell=True) for safety
        result = subprocess.run(
            ["powershell.exe", "-NoProfile", "-NonInteractive", "-Command", full_script],
            capture_output=True,
            text=True,

• Confidence: 94% confidence
• Finding: result = subprocess.run( ["powershell.exe", "-NoProfile", "-NonInteractive", "-Command", full_script], capture_output=True, text=True, encoding=

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env["PYTHONIOENCODING"] = "utf-8"

    try:
        result = subprocess.run(
            cmd_str,
            capture_output=True,
            text=True,

• Confidence: 99% confidence
• Finding: result = subprocess.run( cmd_str, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout,

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return True
    except ImportError:
        print("Installing pyserial...")
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "pyserial>=3.5,<4", "-q"],
            stdout=subprocess.DEVNULL
        )

• Confidence: 96% confidence
• Finding: subprocess.check_call( [sys.executable, "-m", "pip", "install", "pyserial>=3.5,<4", "-q"], stdout=subprocess.DEVNULL )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import psutil
        return psutil
    except ImportError:
        subprocess.check_call([sys.executable, "-m", "pip", "install", "psutil>=5.9.8,<7", "-q"])
        import psutil
        return psutil

• Confidence: 95% confidence
• Finding: subprocess.check_call([sys.executable, "-m", "pip", "install", "psutil>=5.9.8,<7", "-q"])

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill advertises and operationalizes broad execution capabilities including shell commands, file I/O, network access, environment use, and arbitrary script execution, yet declares no explicit permissions or containment boundaries. This creates a dangerous trust gap: a host or reviewer may treat the skill as lower risk than it is, while the skill is actually designed to perform powerful actions across the system and network.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: A battery/power controller should not silently install Python packages at runtime, especially since this capability is not disclosed in the script description. Hidden install behavior can fetch and execute code from package indexes or compromised mirrors, violating least privilege and surprising operators in restricted environments.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Automatic `pip` installation is unjustified for this script’s stated purpose and creates a supply-chain execution path unrelated to battery control. In the context of an 'omniscient' skill that claims broad system-control abilities and universal applicability, this hidden capability is more dangerous because it normalizes unbounded environment modification during routine operations.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The code and comments claim non-private/public URLs are blocked, but _validate_url only warns and then returns the URL. In a skill that exposes generic HTTP and IoT control primitives, this weak validation enables outbound requests to arbitrary hosts, undermining the stated SSRF protection and broadening the attack surface significantly.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module-level security documentation says URLs are validated against SSRF patterns, creating a false sense of safety, but generic HTTP mode still permits arbitrary external URLs after only emitting a warning. In an omnipotent automation skill, misleading security claims are especially dangerous because operators may trust the tool in sensitive environments.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The function calls `netsh wlan show profile ... key=clear`, which reveals saved WiFi credentials in cleartext to any caller of the skill. In the context of an 'omniscient' skill with broad system-control scope, this is especially dangerous because it enables credential harvesting and lateral movement beyond ordinary network management needs.

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: The confirmation helper tells users that `SYSTEM_CONTROLLER_CONFIRM=all` will authorize destructive actions, but the implementation only checks for exact action names in the comma-separated list. This mismatch weakens the safety model and can cause operators or wrappers to believe confirmations are enforced consistently when they are not, undermining trust in guardrails.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This serial utility is described as a device-communication tool, but it also installs software dynamically, expanding its effective capabilities beyond the stated purpose. In a powerful skill that already claims broad system control, hidden or incidental software-management behavior increases risk because it normalizes environment modification and creates an unexpected execution path to fetch and install code.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The skill states that it applies to any task 'without exception,' making its trigger scope effectively unlimited. In an agent ecosystem, such overbroad applicability can cause the skill to be selected for benign-looking requests and then pivot into code execution, GUI automation, system control, or network actions far beyond user expectations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The reference explicitly documents microphone recording commands but provides no consent, notification, or privacy guidance. In a skill that presents itself as universally applicable and capable of broad system control, this omission increases the risk of covert audio capture or misuse in contexts where recording is unexpected or unauthorized.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The documentation states that WiFi profile-detail may reveal saved passwords, which are highly sensitive credentials, yet gives no warning about secret handling. Exposing or normalizing access to stored network passwords can enable credential theft, lateral movement, and compromise of other systems that reuse the same password.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The camera capture commands enable taking photos and saving them to disk without any privacy notice, consent guidance, or indication requirements. In a high-privilege automation skill with device-control scope, this can facilitate surreptitious image capture and collection of sensitive visual data from the user environment.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Screenshot and OCR features can capture passwords, messages, tokens, financial data, and other on-screen secrets, yet the reference presents them as routine utilities without warning. Because this skill also supports GUI automation and arbitrary task chaining, these primitives materially increase the risk of bulk screen scraping and sensitive data extraction.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The Home Assistant and generic HTTP examples include bearer tokens and device-control/data operations but omit warnings about transmitting secrets and operational data over the network. This normalizes unsafe handling of authentication material and can lead to token leakage, unauthorized device control, or exposure of internal service details if used insecurely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Automatic package installation without user-facing disclosure or confirmation is a real security issue in an agent skill because execution can modify the host environment and fetch code from external repositories unexpectedly. In this skill's context of powerful device/system orchestration, silent dependency installation increases operational and supply-chain risk.

VirusTotal

48/48 vendors flagged this skill as clean.