omi · Issues· 1135 open

[Bounty proposal] fix(semantic-scholar): URL normalization, null limit coercion, and connection pooling ($25 proposed)

[Bounty proposal] security(ms365): reflected HTML injection in setup uid and OAuth error page ($50 proposed)

[Bounty proposal] security: omi-dropbox-app reflects raw uid into setup-page HTML (reflected XSS) + stored folder_name sink ($75 proposed)

[Bounty proposal] docs(cli): Spanish agent quickstart and CSV export guide ($60 proposed)

[Bounty proposal] docs(cli): Japanese (ja) agent quickstart ($25 proposed)

[Bounty proposal] docs(cli): bring quickstart.ja.md up to the current localized template ($25 proposed)

increased button functionality + customizable buttons ($500)

[Tested patch] Hacker News tools ignore JSON POST bodies after payload changed to Any

[Bounty $200] security: slack/clickup/twitter transcript webhooks + slack tools trust client-supplied uid — unauthenticated writes into victim workspaces

[Bounty $400] security: seven more plugins — 39 /tools/* routes trust body uid and act with stored third-party credentials

rename my Omi device ($300)

[Bounty $200] security: whoop-app — seven /tools/* routes trust body uid and read the victim's health data

[Plugin] Harden error handling, null guards, and type validation in omi-usgs-earthquake-app

[Bounty proposal] fix(crossref): normalize encoded DOI resolver URLs before lookup ($25 proposed)

omi-twitter-chat-tools-app: /disconnect and /setup/twitter trust bare uid