registry / @castlemilk/omega / 0.6.1

@castlemilk/omega@0.6.1

Omega Harness CLI - installable via npx

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is an Omega Harness CLI/server bundle with local web UI, local API/gRPC, provider configuration, and user-invoked skill generation.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs harness/omega-harness commands such as ui, task run, agent run, or skill generate

Impact

Package-aligned local server/task management; no source-grounded unconsented compromise identified

Mechanism

local harness CLI, localhost API calls, optional provider API calls, user-invoked file generation

Rationale

Static inspection shows risky primitives are tied to explicit CLI/server features: starting a local harness server, localhost polling, configured provider calls, and user-invoked skill adapter generation. I found no install-time execution, credential harvesting, external exfiltration, persistence, destructive behavior, or unconsented AI-agent control-surface mutation.

Evidence

package.jsondist/cli.jsdist/server/src/lib/run-task.tsdist/server/src/routes/tasks.tsdist/server/src/routes/providers.tsdist/server/package.jsondist/server/dist/index.jspackages/skills/src/generated/<ClassName>.tspackages/skills/src/generated/index.tsharness-skills/generated/<ClassName>.tsharness-skills/generated/index.ts

Network endpoints3

localhost:4000localhost:50051localhost:<PORT>

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/cli.js has user-invoked child_process spawn for bundled server or pnpm dev fallback in ui command
dist/cli.js skill generate writes adapter files under OMEGA_HARNESS_ROOT or harness-skills
dist/server routes can store provider apiKey and send prompts to configured providers when tasks are run

Evidence against

package.json has only prepublishOnly build hook, no install/import-time lifecycle execution
dist/cli.js network calls target localhost API/gRPC by default or user-supplied --api/HARNESS_* values
spawned server path is package-local dist/server/dist/index.js or development pnpm fallback, triggered by harness ui
No credential harvesting, external exfiltration endpoint, destructive install behavior, or persistence found
Agent execution is user-triggered via task tags/routes and @omega/agent bundled package appears missing dist implementation

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 560 KB of source, external domains: reactjs.org, www.w3.org

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 408-448javascript

408 title: opts.title,

409 description: opts.description,

410 complexity: opts.complexity,

411 tags: opts.tags ? opts.tags.split(",").map((t) => t.trim()) : []

412 })

413 });

414 console.log(JSON.stringify(task, null, 2));

415});

416taskCmd.command("list").description("List tasks").option("--project <id>", "filter by project id").action(async (opts) => {

417 const query = opts.project ? `?projectId=${opts.project}` : "";

418 const tasks = await apiFetch(`/tasks${query}`);

419 console.log(JSON.stringify(tasks, null, 2));

420});

421taskCmd.command("run").description("Run a task through the router").argument("<id>", "task id").action(async (id) => {

422 const result = await apiFetch(`/tasks/${id}/run`, { method: "POST" });

423 console.log(JSON.stringify(result, null, 2));

424});

425taskCmd.addCommand(taskFeedCmd);

426

427// ../../apps/cli/src/commands/ui.ts

428import { Command as Command4 } from "commander";

429import { spawn } from "child_process";

430import { existsSync as existsSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L428

431import net from "net";

432import path2 from "path";

433import { fileURLToPath as fileURLToPath2 } from "url";

434import open from "open";

435import { render } from "ink";

436import React2 from "react";

437var __filename2 = fileURLToPath2(import.meta.url);

438var __dirname2 = path2.dirname(__filename2);

439var DEFAULT_PORT = 4e3;

440var MAX_PORT = 4010;

441var DEFAULT_GRPC_PORT = 50051;

442var MAX_GRPC_PORT = 50061;

443function findAvailablePort(preferred = DEFAULT_PORT, max = MAX_PORT) {

444 return new Promise((resolve, reject) => {

445 if (preferred > max) {

446 reject(new Error(`No available ports between ${DEFAULT_PORT.toString()} and ${max.toString()}`));

447 return;

448 }

Lines 507-557javascript

507 headers: { "Content-Type": "application/json" },

508 body: JSON.stringify({ name, path: cwd })

509 });

510 if (createRes.ok) {

511 console.log(`Added project: ${name}`);

512 } else {

513 console.warn("Could not auto-add project:"

•matchType = previous_version_dangerous_delta matchedPackage = @castlemilk/omega@0.1.9 matchedIdentity = npm:QGNhc3RsZW1pbGsvb21lZ2E:0.1.9 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.jsView on unpkg

428import { Command as Command4 } from "commander"; L429: import { spawn } from "child_process"; L430: import { existsSync as existsSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L428

537stdio: "inherit", L538: shell: true, L539: env

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L537

527const grpcPort = await findAvailablePort(DEFAULT_GRPC_PORT, MAX_GRPC_PORT); L528: apiUrl = `http://localhost:${port.toString()}`; L529: process.env.HARNESS_API_URL = apiUrl; L530: const env = { ... L535: }; L536: server = startBundledServer(env) ?? spawn("pnpm", ["--filter", "@omega/server", "dev"], { L537: stdio: "inherit",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L527

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/cli.js

HighShelldist/cli.js

HighSame File Env Network Executiondist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 408-448javascript

408 title: opts.title,

409 description: opts.description,

410 complexity: opts.complexity,

411 tags: opts.tags ? opts.tags.split(",").map((t) => t.trim()) : []

412 })

413 });

414 console.log(JSON.stringify(task, null, 2));

415});

416taskCmd.command("list").description("List tasks").option("--project <id>", "filter by project id").action(async (opts) => {

417 const query = opts.project ? `?projectId=${opts.project}` : "";

418 const tasks = await apiFetch(`/tasks${query}`);

419 console.log(JSON.stringify(tasks, null, 2));

420});

421taskCmd.command("run").description("Run a task through the router").argument("<id>", "task id").action(async (id) => {

422 const result = await apiFetch(`/tasks/${id}/run`, { method: "POST" });

423 console.log(JSON.stringify(result, null, 2));

424});

425taskCmd.addCommand(taskFeedCmd);

426

427// ../../apps/cli/src/commands/ui.ts

428import { Command as Command4 } from "commander";

429import { spawn } from "child_process";

430import { existsSync as existsSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L428

431import net from "net";

432import path2 from "path";

433import { fileURLToPath as fileURLToPath2 } from "url";

434import open from "open";

435import { render } from "ink";

436import React2 from "react";

437var __filename2 = fileURLToPath2(import.meta.url);

438var __dirname2 = path2.dirname(__filename2);

439var DEFAULT_PORT = 4e3;

440var MAX_PORT = 4010;

441var DEFAULT_GRPC_PORT = 50051;

442var MAX_GRPC_PORT = 50061;

443function findAvailablePort(preferred = DEFAULT_PORT, max = MAX_PORT) {

444 return new Promise((resolve, reject) => {

445 if (preferred > max) {

446 reject(new Error(`No available ports between ${DEFAULT_PORT.toString()} and ${max.toString()}`));

447 return;

448 }

Lines 507-557javascript

507 headers: { "Content-Type": "application/json" },

508 body: JSON.stringify({ name, path: cwd })

509 });

510 if (createRes.ok) {

511 console.log(`Added project: ${name}`);

512 } else {

513 console.warn("Could not auto-add project:"

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.jsView on unpkg