Skills/PyPI/omni-ai-mcp

omni-ai-mcp@4.8.2

CAUTION· not started

Publisher claims: "MCP server bridging Claude with Google Gemini (video, music, voice, images, Deep Research, agents, 1M context) and 400+ OpenRouter models" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher marmyx77 · publishing for 252 daysInstalls 587Last detonated 22 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
GEMINI_API_KEYGEMINI_MAX_OUTPUT_TOKENSOPENROUTER_API_KEYConfiguration, not credentials: CLAUDE_JSON, GEMINI_ACTIVITY_LOG, GEMINI_CONVERSATION_MAX_TURNS, GEMINI_CONVERSATION_TTL_HOURS, GEMINI_DISABLED_TOOLS, GEMINI_KEY, GEMINI_LOG_BACKUP_COUNT, GEMINI_LOG_DIR, GEMINI_LOG_FORMAT, GEMINI_LOG_MAX_BYTES, GEMINI_MAX_FILE_SIZE, GEMINI_MODEL_AGENT, GEMINI_MODEL_AUTODETECT, GEMINI_MODEL_DEEP_RESEARCH, GEMINI_MODEL_DEEP_RESEARCH_MAX, GEMINI_MODEL_EMBEDDING, GEMINI_MODEL_FLASH, GEMINI_MODEL_FLASH_LITE, GEMINI_MODEL_IMAGE_FLASH, GEMINI_MODEL_IMAGE_LITE, GEMINI_MODEL_IMAGE_PRO, GEMINI_MODEL_MUSIC, GEMINI_MODEL_MUSIC_CLIP, GEMINI_MODEL_PRO, GEMINI_MODEL_ROBOTICS, GEMINI_MODEL_TRANSCRIBE, GEMINI_MODEL_TTS_FLASH, GEMINI_MODEL_TTS_LITE, GEMINI_MODEL_VIDEO, GEMINI_OUTPUT_DIR, GEMINI_REQUEST_TIMEOUT, GEMINI_SANDBOX_ENABLED, GEMINI_SANDBOX_ROOT, OMNI_GEMINI_KEY, OMNI_OPENROUTER_KEY, OPENROUTER_DEFAULT_MODEL, OPENROUTER_KEY
Where it talks to
no vendor host named in the codeAlso astral.sh, google.com, claude.com, google.dev, openrouter.ai, youtube.com, x.dev — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names astral.sh, google.com, claude.com, google.dev, openrouter.ai, youtube.com, x.dev as well as its own vendor. The guard injects GEMINI_API_KEY, GEMINI_MAX_OUTPUT_TOKENS, OPENROUTER_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx omni-ai-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Pipe-to-shell pattern. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.0sprocessexec /usr/bin/dirname
0.0sprocessexited 1: Error: usage: ./setup.sh GEMINI_API_KEY [OPENROUTER_API_KEY] (get a key at https://aistudio.google.com/apikey)
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset
0.2sprocessexec /usr/bin/dirname
0.2sprocessexited 1: Error: usage: ./setup.sh GEMINI_API_KEY [OPENROUTER_API_KEY] (get a key at https://aistudio.google.com/apikey)

Static findings

HIGH
Access to sensitive file pathsapp/core/security.py:295 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Case-folded path: macOS and Windows file systems ignore case (~/.SSH == ~/.ssh)."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsCLAUDE.md:320 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ery ref, glob match and walked file; the deny-list (`sensitive_reason`) covers `~/.ssh`, `.env*`, keys, `~/.claude*`, cloud CLI configs. ### Safe File Writing ```pyt…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandapp/tools/registry.py:253 · File permission modification command — agent changes file ownership/permissions"This is a security risk. Please run: chmod o-w {plugins_dir}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Pipe-to-shell patternCLAUDE.md:171 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -fsSL https://raw.githubusercontent.com/marmyx77/omni-ai-mcp/main/scripts/install_release.sh | bash -s v4.6.5 # a specific tagFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathsapp/core/security.py:275 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".claude.json", ".netrc", ".npmrc", ".pypirc", ".git-credentials", ".pgpass",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedDockerfile:17 · Destructive file system command detectedRUN pip install --no-cache-dir . && rm -rf /root/.cacheFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellCLAUDE.md:170 · Remote installer piped to shellcurl -fsSL https://raw.githubusercontent.com/marmyx77/omni-ai-mcp/main/scripts/install_release.sh | bash # latest tagFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
CRITICAL
Pipe-to-shell patternscripts/build_dxt.sh:10 · Pipe-to-shell pattern — downloads and immediately executes remote code# macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Remote installer piped to shellscripts/build_dxt.sh:10 · Remote installer piped to shell# macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File type combined with upload actionCLAUDE.md:320 · File type combined with upload action — agent may exfiltrate local data files…uction and hook files (`write_protected_reason`: `CLAUDE.md`, `AGENTS.md`, `.mcp.json`, `.git/`, `.claude/`, `.vscode/`…), `gemini_generate_code` included. Globs are checked on their fixed prefix before walking (`glob_root_allowed`). The d…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Prompting user to enter sensitive credentials.claude/commands/setup.md:2 · Prompting user to enter sensitive credentials — social engineeringdescription: "Setup omni-ai-mcp: enter your API key in chat to configure everything automatically"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
CRITICAL
Pipe-to-shell patternscripts/build_dxt.sh:61 · Pipe-to-shell pattern — downloads and immediately executes remote codeecho " macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | sh"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Remote installer piped to shellCLAUDE.md:171 · Remote installer piped to shellcurl -fsSL https://raw.githubusercontent.com/marmyx77/omni-ai-mcp/main/scripts/install_release.sh | bash -s v4.6.5 # a specific tagFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File type combined with upload actionapp/tools/text/embed.py:151 · File type combined with upload action — agent may exfiltrate local data filespath = safe_output_path(output_path, {".json"}) if output_path else default_output_path("gemini_embeddings", ".json")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Pipe-to-shell pattern.claude/commands/setup.md:11 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Direct script execution from GitHub raw URLCLAUDE.md:171 · Direct script execution from GitHub raw URL — unverified code sourcecurl -fsSL https://raw.githubusercontent.com/marmyx77/omni-ai-mcp/main/scripts/install_release.sh | bash -s v4.6.5 # a specific tagFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandDockerfile:25 · File permission modification command — agent changes file ownership/permissionsRUN mkdir -p /workspace /logs && chown omni:omni /workspace /logsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
URL with embedded credentialsapp/core/security.py:620 · URL with embedded credentials — may be phishing or credential leaking# Password in URLs (http://user:pass@host)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
CRITICAL
Pipe-to-shell patternscripts/build_plugin.sh:16 · Pipe-to-shell pattern — downloads and immediately executes remote code# macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathsapp/core/security.py:280 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSENSITIVE_FILE_PREFIXES = ("id_rsa", "id_dsa", "id_ecdsa", "id_ed25519", ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Pipe-to-shell patternCLAUDE.md:170 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -fsSL https://raw.githubusercontent.com/marmyx77/omni-ai-mcp/main/scripts/install_release.sh | bash # latest tagFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Direct script execution from GitHub raw URLCLAUDE.md:170 · Direct script execution from GitHub raw URL — unverified code sourcecurl -fsSL https://raw.githubusercontent.com/marmyx77/omni-ai-mcp/main/scripts/install_release.sh | bash # latest tagFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsmanifest.json:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"description": "Optional. The only folder the tools may read files from and save files to. Empty = ~/omni-ai-workspace (created on first run). Credentials (~/.ssh, .env, keys) are always refused.",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shell.claude/commands/setup.md:11 · Remote installer piped to shellcurl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Remote installer piped to shellscripts/build_dxt.sh:61 · Remote installer piped to shellecho " macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | sh"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandsetup.sh:70 · File permission modification command — agent changes file ownership/permissionschmod 600 "$BACKUP"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesCONTRIBUTING.md:54 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file5. Update the tool count and tables (README, CLAUDE.md «Available Tools», `tests/integration/test_fastmcp_server.py`) and add a check to `scripts/smoke_live.py`.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Fake instruction boundary tagREADME.md:292 · Fake instruction boundary tag · informational: not an instruction file| `/ask-model [model] <prompt>` | Ask any model (GPT, Claude, Llama, Grok, …) |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Remote installer piped to shellscripts/build_plugin.sh:16 · Remote installer piped to shell# macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandscripts/install_release.sh:90 · File permission modification command — agent changes file ownership/permissionschmod 600 "$BACKUP"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈12,020 tok
3 files · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for omni-ai-mcp@4.8.2 as of 22 h ago. This is the package itself, not its dependencies.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim marmyx77: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Pipe-to-shell pattern≈ +4 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  4. Prompting user to enter sensitive credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  6. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim marmyx77Propose a patch to the maintainer