omni-version-manager

Warn

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
  • [COMMAND_EXECUTION]: The skill manages the execution and lifecycle of several local services (9Router, CLIProxyAPI, Mux, open-wa, Bifrost, and Dario) by controlling their processes through a local API.
  • [EXTERNAL_DOWNLOADS]: Fetches and updates services from the NPM registry and triggers the download of necessary binaries, such as Chromium for the open-wa automation service and Go binaries for the Bifrost service.
  • [CREDENTIALS_UNSAFE]: Interacts with sensitive credential files, specifically reading and writing OAuth token pairs in the ~/.dario/accounts/ directory and managing API keys for the 9Router service.
  • [INDIRECT_PROMPT_INJECTION]: The skill monitors service logs through an SSE stream, which creates a potential surface for indirect prompt injection if those logs contain untrusted content from the managed services.
  • Ingestion points: Service logs accessed via the /api/services/{name}/logs endpoint.
  • Boundary markers: The documentation does not specify the use of delimiters or warnings to prevent the agent from interpreting log content as instructions.
  • Capability inventory: The skill possesses significant capabilities, including service installation, process management, and credential manipulation.
  • Sanitization: There is no evidence of sanitization or filtering applied to the log data before it is presented to the agent.
  • [PERSISTENCE]: Includes features to establish persistence for managed services, specifically through auto-start and auto-restart-adopted configurations that ensure services remain running across system reboots.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 15, 2026, 09:02 AM