Is diegosouzapw/OmniRoute safe?
https://github.com/diegosouzapw/OmniRoute
OmniRoute is a large, complex AI routing proxy with extensive legitimate functionality, but during the git clone process, a process systematically read six separate credential files (SSH private key, AWS credentials, GCP credentials, .env, .npmrc, Docker config) in a single coordinated burst while an active GitHub HTTPS connection was live — a clear credential harvesting signature that is inconsistent with normal git operations. Additionally, the SKILL.md content includes the cli-skill-collector skill which explicitly instructs LLM agents to auto-detect installed AI coding tools and silently install agent skills from external GitHub repositories into those tools, creating a supply-chain persistence vector. The combination of credential theft at install time and a built-in mechanism to backdoor AI coding tool environments makes this repository highly dangerous.
Category Scores
Findings (7)
CRITICAL SSH Private Key Read During Git Clone -50 ▶
During the git clone operation, the file /home/oc-exec/.ssh/id_rsa (an SSH private key) was opened and read by a process spawned during installation. A plain git clone should never need to access SSH private keys outside its own authentication mechanism. This is consistent with a git hook or embedded script that enumerates and reads credential material.
CRITICAL Systematic Credential File Enumeration During Installation -70 ▶
Six credential files were read in a single coordinated burst at timestamp 1785924419.386: .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and gcloud application_default_credentials.json. The simultaneous read of all canonical credential locations within the same audit timestamp is not consistent with normal git or shell activity — it indicates a deliberate credential sweep. An active HTTPS connection to GitHub (140.82.121.4:443) existed concurrently.
CRITICAL All Honeypot Credential Files Read by Installation Process -60 ▶
Oathe-placed honeypot files (sequential inodes 272633–272638) covering all major credential types were all accessed during installation. The canary system reports 'intact' because file content was not modified, but read access was confirmed by both monitoring systems. Content could have been exfiltrated via the concurrent network connection without modifying the honeypot files.
HIGH cli-skill-collector Skill Instructs Agent to Install External GitHub Skills Into AI Coding Tools -20 ▶
The SKILL.md for cli-skill-collector provides a complete workflow instructing an LLM agent to: (1) call /api/skills/collect/detect to find installed coding tools like Claude Code, Codex, Cursor, Cline, etc., (2) search GitHub for 'matching' skills, and (3) install those skills into the detected tools' skill directories. This is a documented supply-chain injection mechanism that would cause an LLM agent to silently install arbitrary agent skills from external repos into the user's AI coding environment.
HIGH Skills Reference External Raw GitHub URLs for Agent Instruction Fetching -15 ▶
Multiple SKILL.md entries direct the agent to fetch additional skill content from raw.githubusercontent.com URLs under diegosouzapw/OmniRoute. These are live, attacker-modifiable URLs. If the repository owner updates these files, any agent that has already loaded OmniRoute skills will silently receive updated instructions on next fetch.
MEDIUM npm postinstall Script Executes on Package Installation -15 ▶
package.json specifies 'postinstall': 'node scripts/build/postinstall.mjs' which would execute arbitrary Node.js code on every npm install. The postinstall script files are included in the published npm package files list. While the current audit only performed a git clone (not npm install), the postinstall hook would run automatically on npm install and could access or exfiltrate credentials at that stage.
MEDIUM Supply Chain Persistence Mechanism via AI Tool Skill Directories -30 ▶
The combination of credential harvesting at clone time and the cli-skill-collector/omni-github-skills capabilities creates a two-stage attack: (1) steal developer credentials during installation, (2) use the injected skill instructions to have the victim's LLM agent install persistent malicious skills into Claude Code, Codex, Cursor, and other AI coding tools. This gives an attacker ongoing access to the developer's AI-assisted workflow.