registry / @herjarsa/omo-meta-governor / 0.29.1

@herjarsa/omo-meta-governor@0.29.1

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

AI Security Review

scanned 24d ago · by lpm-firewall-ai

The automatic global skill installation is a concrete agent-extension lifecycle risk despite the lack of an npm install hook. The source supports a warning rather than a block because activation occurs through the extension and no active malicious behavior was identified.

Static reason

One or more suspicious static signals were detected.

Trigger

Activation of the registered extension with CLI synchronization enabled, which is the default unless configuration disables it.

Impact

It can alter the user's agent-tool environment by adding an external skill; no broader confirmed attack surface was established.

Mechanism

The extension invokes child-process based CLI setup and defaults its installation scope to global.

AI rationale

Evidence

dist/index.jsdist/lib.js~/.config/opencode/omo-cli-anything-upgrade-check.json

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package metadata defines build, type-check, and test scripts, with no npm install lifecycle hook.
The primary entrypoint starts CLI synchronization unless its feature is disabled and forwards automatic-install settings.
Both distributed entrypoints implement automatic CLI skill setup with automatic installation enabled by default and a global scope default.
The secondary entrypoint constructs a command that adds the CLI-Anything meta-skill globally when that scope is selected.

Evidence against

No npm preinstall, install, or postinstall hook was found in the package metadata.
No direct credential collection or package-controlled network recipient was identified in the inspected paths.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

7 flagged

dist/lib.jsView file

1import{createRequire as _f}from"node:module";var{defineProperty:ho,getOwnPropertyNames:mf,getOwnPropertyDescriptor:pf}=Object,ff=Object.prototype.hasOwnProperty;function gf(e){retu... L2: `}catch{c=JSON.stringify({timestamp:s.timestamp,level:e,message:r,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

2`}catch{c=JSON.stringify({timestamp:s.timestamp,level:e,message:r,data:"[unserializable]"})+` L3: `}try{xf(pe,c)}catch{}if(e==="error")console.error(`[meta-governor] ${r}`)}function I(e,r,n){Uu(e,r,n)}function Mf(e){Uu(e.level,e.message,e.data,e.event,e.sessionID)}function Af()... L4: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

112`)}}saveMemory(e){let r=yd("M"),n=(e.concepts[0]??"memory").slice(0,80);return this.stmts.insertEntry.run(r,"memory",n,e.content,"",null,0.5,JSON.stringify(e.concepts),JSON.stringi... L113: `)[0]??"lesson").slice(0,80);return this.stmts.insertEntry.run(r,"lesson",o,e.content,e.context,null,n,JSON.stringify(e.tags??[]),JSON.stringify([]),"","",Date.now()),Promise.resol... L114: `)}var mt=(e)=>(r,n,o,t)=>{let i=o?Object.assign(o,{async:!1}):{async:!1},a=r._zod.run({value:n,issues:[]},i);if(a instanceof Promise)throw new Ie;if(a.issues.length){let s=new(t?....

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L112

dist/index.jsView file

1Cross-file remote execution chain: dist/index.js spawns dist/lib.js; helper contains network access plus dynamic code execution. L1: import{createRequire as pf}from"node:module";var{defineProperty:ao,getOwnPropertyNames:of,getOwnPropertyDescriptor:af}=Object,sf=Object.prototype.hasOwnProperty;function cf(e){retu... L2: `}catch{c=JSON.stringify({timestamp:s.timestamp,level:e,message:r,data:"[unserializable]"})+` L3: `}try{hf(pe,c)}catch{}if(e==="error")console.error(`[meta-governor] ${r}`)}function T(e,r,n){xu(e,r,n)}function Of(e){xu(e.level,e.message,e.data,e.event,e.sessionID)}function Df()... L4: const OMO_MG_WATCH = 1; ... L18: setInterval(run, 30_000); L19: `],{stdio:"ignore",detached:!0,shell:!1,env:{...process.env,OMO_MG_SPAWN:"1"}});else o=wu("python3",["-m","graphify",".","--no-vi

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

191ed&&w.availability.codegraph&&w.availability.graphify)du.add(_e)}).catch(()=>{}),O.cliAnything?.enabled!==!1){let w=Ze.config?.cliAnything??de?.meta_governor?.cliAnything;(r.__test_runCliAnythingSync??Lu)({enabled:!0,autoInstall:w?.autoInstall??!0,autoUpgrade:w?.autoUpgrade??!0,cachePath:w?.cachePath??`${process.env.HOME||process.env.USERPROFILE||"~"}/.config/opencode/omo-cli-anything-upgrade-check.json`,upgradeCheck

Medium

Ai Review Evidence

The primary entrypoint starts CLI synchronization unless its feature is disabled and forwards automatic-install settings.

dist/index.jsView on unpkg · L191

package.jsonView file

22"scripts": { "build": "bun build.ts", "typecheck": "tsc --noEmit", "test": "bun test" }, "peerDependencies":

Medium

Suspicious Lifecycle Evidence

The package metadata defines build, type-check, and test scripts, with no npm install lifecycle hook.

package.jsonView on unpkg · L22

Source & flagged code

7 flagged · loading source

dist/lib.jsView file

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.js

Findings

4 High4 Medium4 Low

HighChild Processdist/lib.js

HighShelldist/lib.js

HighCross File Remote Execution Contextdist/index.js

HighRuntime Package Installdist/lib.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencedist/index.js

LowScripts Present

LowEvaldist/lib.js

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @herjarsa/omo-meta-governor@0.29.1.

See all versions of @herjarsa/omo-meta-governor for other recorded verdicts.

Review the evidence and your use of @herjarsa/omo-meta-governor@0.29.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-29 10:43:16.878Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.