omada-controller

The code is a legitimate Omada API convenience wrapper and contains no clear malware, credential exfiltration, persistence, or destructive behavior. Its main security weakness is the universal use of curl -k, which disables TLS verification and can expose OMADA_SECRET and access tokens to a man-in-the-middle attacker. The .env parsing and direct JSON interpolation are fragile and should be hardened. Use of arbitrary paths, methods, and jq filters appears intentional wrapper functionality. Review and modify before production use, especially to enable certificate verification.