registry / AI-agent capability abuse / @herjarsa/omo-meta-governor / 0.33.6

@herjarsa/omo-meta-governor@0.33.6

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The package has no npm install lifecycle hook and its agent-configuration hint locations only inspect plan markers. However, plugin initialization defaults to automatic CLI-Anything installation and upgrading in global scope, so this warrants a warning for agent capability risk rather than a malicious verdict.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

The OpenCode plugin initializes with CLI-Anything enabled, unless disabled by configuration.

Impact

External CLI components may be installed or upgraded as part of plugin initialization.

Mechanism

Initialization invokes the CLI-Anything synchronization routine with automatic installation and upgrading enabled and global scope by default; a separate MCP tool can install a named CLI.

AI rationale

Evidence

dist/lib.js~/.config/opencode/omo-cli-anything-upgrade-check.json

Network endpoints2

skills.sh/api/searchskills.sh/api/download

Decision evidence

public snapshot

AI called this Suspicious at 81.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest has no install lifecycle hook; it exposes a plugin entrypoint and an MCP server command.
Both agent-configuration hint locations are plan-marker checks, not writes to agent configuration.
Plugin initialization starts CLI-Anything setup with automatic installation and upgrading enabled by default, using global scope.
The package also exposes an explicit MCP tool for installing a named CLI from the CLI-Anything hub.

Evidence against

The inspected source does not establish credential harvesting or exfiltration, or a hidden command-output exfiltration path.
The external install capability is presented as a CLI-Anything setup tool; no install-time lifecycle trigger is present.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

Source & flagged code

9 flagged

dist/lib.jsView file

Lines 1-22javascript

1import{createRequire as SX}from"node:module";var{defineProperty:GU,getOwnPropertyNames:GX,getOwnPropertyDescriptor:AX}=Object,HX=Object.prototype.hasOwnProperty;function EX($){return this[$]}var ZX=($)=>{var v=(u2??=new WeakMap).get($),b;if(v)return v;if(v=GU({},"__esModule",{value:!0}),$&&typeof $==="object"||typeof $==="function"){for(var z of GX($))if(!HX.call(v,z))GU(v,z,{get:EX.bind($,z),enumerable:!(b=AX($,z))||b.enumerable})}return u2.set($,v),v},u2,FX=($,v)=>()=>(v||$((v={exports:{}}).exports,v),v.exports);var MX=($)=>$;function rX($,v){this[$]=MX.bind(null,v)}var Y$=($,v)=>{for(var b ...

2`}catch{J=JSON.stringify({timestamp:O.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

3`}try{RX(J$,J)}catch{}if($==="error")console.error(`[meta-governor] ${v}`)}function E($,v,b){l2($,v,b)}function lX($){l2($.level,$.message,$.data,$.event,$.sessionID)}function oX(){try{if(c4(J$))return n2(J$).size}catch{}return 0}function dX(){let $=0;for(let v=1;v<=EU;v++)if(c4(`${J$}.${v}`))$=v;else break;return $}var uX,yX,J$,fX=10485760,EU=5;var Cv=o$(()=>{uX=[/eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,/sk-(?:proj-|svc-|)[a-zA-Z0-9]{20,}/g,/pk-[a-zA-Z0-9]{20,}/g,/ghp_[a-zA-Z0-9]{36,}/g,/ghs_[a-zA-Z0-9]{36,}/g,/github_pat_[a-zA-Z0-9]{22,}/g,/Bearer\s+[a-zA-Z0-9_\-]{20,}/gi,/(?:key ...

4 const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

5 const {spawn} = require("child_process");

6 const run = () => {

7 try {

8 const c = spawn("npx", ["codegraph", "update"], {

9 cwd: ${JSON.stringify($)},

10 stdio: "ignore",

11 windowsHide: true,

12 shell: false,

13 });

14 c.unref();

15 } catch(e) { /* best effort */ }

16 };

17 run();

18 setInterval(run, 30_000);

19 `],{stdio:"ignore",detached:!0,shell:!1,env:{...process.env,OMO_MG_SPAWN:"1"}});else z=o2("python3",["-m","graphify",".","--no-viz","--watch"],{cwd:$,stdio:"ignore",detached:!0

20`)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if(U)return U[1]}catch{}for(let v of["python","python3"])try{let z=d(v,["-c","import urllib.request, json; d=json.load(urllib.request.urlopen('https://pypi.org/pypi/graphifyy/json')); print(d['info']['version'])"],{timeoutMs:1e4}).stdout.trim();if(z.length>0)return z}catch{}return null}async function xU($){let v=[{bin:"npx",args:["--yes","codegraph","--version"]},{bin:"node",args:["node_modules/.bin/codegraph","--version"]}];for(let{bin:b,args:z}of v)try{let U;if($){let N=$(`${b} ${z.join(" ")}`,{stdio:"ignore",timeout:1e4});U= ...

22Please call the \`${v.mcpTool}\` MCP tool with EXACTLY these args:

Long lines were clipped for display.

Lines 146-186javascript

146 ORDER BY priority ASC, updated_at_ms DESC

147 `)}}saveMemory($){let v=M0("M"),b=($.concepts[0]??"memory").slice(0,80);return this.stmts.insertEntry.run(v,"memory",b,$.content,"",null,0.5,JSON.stringify($.concepts),JSON.stringify($.files??[]),"","",Date.now()),Promise.resolve({id:v})}saveLesson($){let v=M0("L"),b=$.confidence??0.5,z=($.content.split(`

148`)[0]??"lesson").slice(0,80);return this.stmts.insertEntry.run(v,"lesson",z,$.content,$.context,null,b,JSON.stringify($.tags??[]),JSON.stringify([]),"","",Date.now()),Promise.resolve({id:v})}smartSearch($){let v=$.limit??10,b=this.toFtsQuery($.query),U=this.stmts.ftsSearch.all(b,v).map((_)=>({id:_.id,title:_.title,content:_.content,type:_.kind,concepts:r0(_.tags),confidence:_.confidence,files:r0(_.files),advice:_.advice??"info"}));return Promise.resolve({lessons:U,crystals:[]})}boulderRead($){let b=this.stmts.boulderSelect.all($.directory,$.sessionID).map((z)=>({id:z.id,title:z.title,priority: ...

149 FROM skills s

150 JOIN skills_fts f ON f.rowid = (SELECT rowid FROM skills WHERE id = s.id)

151 ${

dist/mcp-server.jsView file

4|| (${X} === "string" && ${b} && ${b} == +${b} && !(${b} % 1))`).assign(W,X$._`+${b}`);return;case"boolean":z.elseIf(X$._`${b} === "false" || ${b} === 0 || ${b} === null`).assign(W... L5: || ${X} === "boolean" || ${b} === null`).assign(W,X$._`[${b}]`)}}}function kx({gen:$,parentData:v,parentDataProperty:U},z){$.if(X$._`${v} !== undefined`,()=>$.assign(X$._`${v}[${U}... L6: missingProperty: ${z}, L7: depsCount: ${v}, L8: deps: ${U}}`};var Dm={keyword:"dependencies",type:"object",schemaType:"object",error:oS.error,code($){let[v,U]=Km($);nS($,v),iS($,U)}};function Km({schema:$}){let v={},U={};for(let... L9: `}catch{O=JSON.stringify({timestamp:W.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as d_}from"node:module";var y_=Object.create;var{getPrototypeOf:m_,defineProperty:JN,getOwnPropertyNames:c_}=Object;var r_=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new s4.Scope({parent:$}),this._nodes=[new mq]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${X} == "string" && ${b} && ${b} == +${b})`).assign(W,X$._`+${b}`);return;case"integer":z.elseIf(X$._`${X} === "boolean" || ${b} === null L4: || (${X} === "string" && ${b} && ${b} == +${b} && !(${b} % 1))`).assign(W,X$._`+${b}`);return;case"boolean":z.elseIf(X$._`${b} === "false" || ${b} === 0 || ${b} === null`).assign(W... L5: || ${X} === "boolean" || ${b} === null`).assign(W,X$._`[${b}]`)}}}function kx({gen:$,p

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

dist/index.jsView file

Lines 1-21javascript

1import{createRequire as GX}from"node:module";var{defineProperty:YU,getOwnPropertyNames:wX,getOwnPropertyDescriptor:jX}=Object,VX=Object.prototype.hasOwnProperty;function PX($

Source & flagged code

9 flagged · loading source

dist/lib.jsView file

1import{createRequire as SX}from"node:module";var{defineProperty:GU,getOwnPropertyNames:GX,getOwnPropertyDescriptor:AX}=Object,HX=Object.prototype.hasOwnProperty;function EX($){retu... L2: `}catch{J=JSON.stringify({timestamp:O.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

1import{createRequire as SX}from"node:module";var{defineProperty:GU,getOwnPropertyNames:GX,getOwnPropertyDescriptor:AX}=Object,HX=Object.prototype.hasOwnProperty;function EX($){retu... L2: `}catch{J=JSON.stringify({timestamp:O.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

2`}catch{J=JSON.stringify({timestamp:O.timestamp,level:$,message:v,data:"[unserializable]"})+` L3: `}try{RX(J$,J)}catch{}if($==="error")console.error(`[meta-governor] ${v}`)}function E($,v,b){l2($,v,b)}function lX($){l2($.level,$.message,$.data,$.event,$.sessionID)}function oX()... L4: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.js

Findings

8 High3 Medium4 Low

HighChild Processdist/lib.js

HighShelldist/lib.js

HighSame File Env Network Executiondist/mcp-server.js

HighCommand Output Exfiltrationdist/mcp-server.js

HighCross File Remote Execution Contextdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/mcp-server.js

HighRuntime Package Installdist/lib.js

HighKnown Malware Source Similaritydist/mcp-server.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/lib.js

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @herjarsa/omo-meta-governor@0.33.6.

See all versions of @herjarsa/omo-meta-governor for other recorded verdicts.

Review the evidence and your use of @herjarsa/omo-meta-governor@0.33.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 21:43:20.524Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.