registry / @herjarsa/omo-meta-governor / 0.31.3

@herjarsa/omo-meta-governor@0.31.3

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.45 MB of source, external domains: github.com, json-schema.org, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

5 flagged

dist/lib.jsView file

Lines 1-22javascript

1import{createRequire as Ek}from"node:module";var{defineProperty:VU,getOwnPropertyNames:Pk,getOwnPropertyDescriptor:qk}=Object,Lk=Object.prototype.hasOwnProperty;function Bk($){return this[$]}var Gk=($)=>{var U=(m2??=new WeakMap).get($),b;if(U)return U;if(U=VU({},"__esModule",{value:!0}),$&&typeof $==="object"||typeof $==="function"){for(var z of Pk($))if(!Lk.call(U,z))VU(U,z,{get:Bk.bind($,z),enumerable:!(b=qk($,z))||b.enumerable})}return m2.set($,U),U},m2,rk=($,U)=>()=>(U||$((U={exports:{}}).exports,U),U.exports);var Ak=($)=>$;function Hk($,U){this[$]=Ak.bind(null,U)}var K$=($,U)=>{for(var b ...

2`}catch{J=JSON.stringify({timestamp:O.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

3`}try{Zk(O$,J)}catch{}if($==="error")console.error(`[meta-governor] ${U}`)}function A($,U,b){u2($,U,b)}function yk($){u2($.level,$.message,$.data,$.event,$.sessionID)}function fk(){try{if(m4(O$))return h2(O$).size}catch{}return 0}function nk(){let $=0;for(let U=1;U<=LU;U++)if(m4(`${O$}.${U}`))$=U;else break;return $}var Tk,Ck,O$,hk=10485760,LU=5;var gv=n$(()=>{Tk=[/eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,/sk-(?:proj-|svc-|)[a-zA-Z0-9]{20,}/g,/pk-[a-zA-Z0-9]{20,}/g,/ghp_[a-zA-Z0-9]{36,}/g,/ghs_[a-zA-Z0-9]{36,}/g,/github_pat_[a-zA-Z0-9]{22,}/g,/Bearer\s+[a-zA-Z0-9_\-]{20,}/gi,/(?:key ...

4 const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

5 const {spawn} = require("child_process");

6 const run = () => {

7 try {

8 const c = spawn("npx", ["codegraph", "update"], {

9 cwd: ${JSON.stringify($)},

10 stdio: "ignore",

11 windowsHide: true,

12 shell: false,

13 });

14 c.unref();

15 } catch(e) { /* best effort */ }

16 };

17 run();

18 setInterval(run, 30_000);

19 `],{stdio:"ignore",detached:!0,shell:!1,env:{...process.env,OMO_MG_SPAWN:"1"}});else z=y2("python3",["-m","graphify",".","--no-viz","--watch"],{cwd:$,stdio:"ignore",detached:!0

20`)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if(v)return v[1]}catch{}for(let U of["python","python3"])try{let z=o(U,["-c","import urllib.request, json; d=json.load(urllib.request.urlopen('https://pypi.org/pypi/graphifyy/json')); print(d['info']['version'])"],{timeoutMs:1e4}).stdout.trim();if(z.length>0)return z}catch{}return null}async function FU($){let U=[{bin:"npx",args:["--yes","codegraph","--version"]},{bin:"node",args:["node_modules/.bin/codegraph","--version"]}];for(let{bin:b,args:z}of U)try{let v;if($){let N=$(`${b} ${z.join(" ")}`,{stdio:"ignore",timeout:1e4});v= ...

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/lib.jsView on unpkg · L1

22Please call the \`${U.mcpTool}\` MCP tool with EXACTLY these args:

Long lines were clipped for display.

Lines 139-179javascript

139 `)}}saveMemory($){let U=rO("M"),b=($.concepts[0]??"memory").slice(0,80);return this.stmts.insertEntry.run(U,"memory",b,$.content,"",null,0.5,JSON.stringify($.concepts),JSON.stringify($.files??[]),"","",Date.now()),Promise.resolve({id:U})}saveLesson($){let U=rO("L"),b=$.confidence??0.5,z=($.content.split(`

140`)[0]??"lesson").slice(0,80);return this.stmts.insertEntry.run(U,"lesson",z,$.content,$.context,null,b,JSON.stringify($.tags??[]),JSON.stringify([]),"","",Date.now()),Promise.resolve({id:U})}smartSearch($){let U=$.limit??10,b=this.toFtsQuery($.query),v=this.stmts.ftsSearch.all(b,U).map((_)=>({id:_.id,title:_.title,content:_.content,type:_.kind,concepts:AO(_.tags),confidence:_.confidence,files:AO(_.files),advice:_.advice??"info"}));return Promise.resolve({lessons:v,crystals:[]})}boulderRead($){let b=this.stmts.boulderSelect.all($.directory,$.sessionID).map((z)=>({id:z.id,title:z.title,priority: ...

141 FROM skills s

142 JOIN skills_fts f ON f.rowid = (SELECT rowid FROM skills WHERE id = s.id)

143 ${z}

144 ORDER BY rank

145 LIMIT ?`).all

Source & flagged code

5 flagged · loading source

dist/lib.jsView file

1import{createRequire as Ek}from"node:module";var{defineProperty:VU,getOwnPropertyNames:Pk,getOwnPropertyDescriptor:qk}=Object,Lk=Object.prototype.hasOwnProperty;function Bk($){retu... L2: `}catch{J=JSON.stringify({timestamp:O.timestamp,level:$,message:U,data:"[unserializable]"})+`

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code