omni-version-manager
Warn
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The skill manages the execution and lifecycle of several local services (9Router, CLIProxyAPI, Mux, open-wa, Bifrost, and Dario) by controlling their processes through a local API.
- [EXTERNAL_DOWNLOADS]: Fetches and updates services from the NPM registry and triggers the download of necessary binaries, such as Chromium for the
open-waautomation service and Go binaries for theBifrostservice. - [CREDENTIALS_UNSAFE]: Interacts with sensitive credential files, specifically reading and writing OAuth token pairs in the
~/.dario/accounts/directory and managing API keys for the 9Router service. - [INDIRECT_PROMPT_INJECTION]: The skill monitors service logs through an SSE stream, which creates a potential surface for indirect prompt injection if those logs contain untrusted content from the managed services.
- Ingestion points: Service logs accessed via the
/api/services/{name}/logsendpoint. - Boundary markers: The documentation does not specify the use of delimiters or warnings to prevent the agent from interpreting log content as instructions.
- Capability inventory: The skill possesses significant capabilities, including service installation, process management, and credential manipulation.
- Sanitization: There is no evidence of sanitization or filtering applied to the log data before it is presented to the agent.
- [PERSISTENCE]: Includes features to establish persistence for managed services, specifically through
auto-startandauto-restart-adoptedconfigurations that ensure services remain running across system reboots.
Audit Metadata