omniroute-cli-eval
Warn
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill links to a raw skill definition file on GitHub (
diegosouzapw/OmniRoute) to provide installation instructions for the requiredomnirouteCLI. This repository is hosted on a personal account and is not associated with an established trusted vendor organization.\n- [DYNAMIC_EXECUTION]: The 'CI integration' section includes a bash script example that demonstrates an unsafe practice of interpolating shell variables into code executed by an interpreter. It passes a variable ($SCORE) derived from theomnirouteCLI output directly into apython3 -ccommand without sanitization.\n - Evidence:
python3 -c \"import sys; score=float('$SCORE'); sys.exit(0 if score >= 0.90 else 1)\"\n - Risk: If the evaluation tool returns a specially crafted string instead of a numeric value, it could result in the execution of arbitrary Python code when the CI script runs.
Audit Metadata