registry / @herjarsa/omo-meta-governor / 0.34.2

@herjarsa/omo-meta-governor@0.34.2

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.71 MB of source, external domains: 127.0.0.1, github.com, json-schema.org, raw.githubusercontent.com, skills-library.com, skills.sh

Source & flagged code

7 flagged

dist/lib.jsView file

Lines 1-22javascript

1import{createRequire as gK}from"node:module";var{defineProperty:ZU,getOwnPropertyNames:MK,getOwnPropertyDescriptor:FK}=Object,SK=Object.prototype.hasOwnProperty;function rK($){return this[$]}var DK=($)=>{var U=(i2??=new WeakMap).get($),b;if(U)return U;if(U=ZU({},"__esModule",{value:!0}),$&&typeof $==="object"||typeof $==="function"){for(var z of MK($))if(!SK.call(U,z))ZU(U,z,{get:rK.bind($,z),enumerable:!(b=FK($,z))||b.enumerable})}return i2.set($,U),U},i2;var xK=($)=>$;function RK($,U){this[$]=xK.bind(null,U)}var V$=($,U)=>{for(var b in U)ZU($,b,{get:U[b],enumerable:!0,configurable:!0,set:RK. ...

2`}catch{O=JSON.stringify({timestamp:J.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

3`}try{mK(X$,O)}catch{}if($==="error")console.error(`[meta-governor] ${U}`)}function H($,U,b){t2($,U,b)}function tK($){t2($.level,$.message,$.data,$.event,$.sessionID)}function aK(){try{if(f4(X$))return o2(X$).size}catch{}return 0}function eK(){let $=0;for(let U=1;U<=SU;U++)if(f4(`${X$}.${U}`))$=U;else break;return $}var iK,lK,X$,dK=10485760,SU=5;var hv=o$(()=>{iK=[/eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,/sk-(?:proj-|svc-|)[a-zA-Z0-9]{20,}/g,/pk-[a-zA-Z0-9]{20,}/g,/ghp_[a-zA-Z0-9]{36,}/g,/ghs_[a-zA-Z0-9]{36,}/g,/github_pat_[a-zA-Z0-9]{22,}/g,/Bearer\s+[a-zA-Z0-9_\-]{20,}/gi,/(?:key ...

4 const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

5 const {spawn} = require("child_process");

6 const run = () => {

7 try {

8 const c = spawn("npx", ["codegraph", "update"], {

9 cwd: ${JSON.stringify($)},

10 stdio: "ignore",

11 windowsHide: true,

12 shell: false,

13 });

14 c.unref();

15 } catch(e) { /* best effort */ }

16 };

17 run();

18 setInterval(run, 30_000);

19 `],{stdio:"ignore",detached:!0,shell:!1,env:{...process.env,OMO_MG_SPAWN:"1"}});else z=a2("python3",["-m","graphify",".","--no-viz"

20`)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if(v)return v[1]}catch{}for(let U of["python","python3"])try{let z=a(U,["-c","import urllib.request, json; d=json.load(urllib.request.urlopen('https://pypi.org/pypi/graphifyy/json')); print(d['info']['version'])"],{timeoutMs:1e4}).stdout.trim();if(z.length>0)return z}catch{}return null}async function TU($){let U=[{bin:"npx",args:["--yes","codegraph","--version"]},{bin:"node",args:["node_modules/.bin/codegraph","--version"]}];for(let{bin:b,args:z}of U)try{let v;if($){let N=$(`${b} ${z.join(" ")}`,{stdio:"ignore",timeout:1e4});v= ...

22Please call the \`${U.mcpTool}\` MCP tool with EXACTLY these args:

Long lines were clipped for display.

Lines 146-186javascript

146 ORDER BY priority ASC, updated_at_ms DESC

147 `)}}saveMemory($){let U=xJ("M"),b=($.concepts[0]??"memory").slice(0,80);return this.stmts.insertEntry.run(U,"memory",b,$.content,"",null,0.5,JSON.stringify($.concepts),JSON.stringify($.files??[]),"","",Date.now()),Promise.resolve({id:U})}saveLesson($){let U=xJ("L"),b=$.confidence??0.5,z=($.content.split(`

148`)[0]??"lesson").slice(0,80);return this.stmts.insertEntry.run(U,"lesson",z,$.content,$.context,null,b,JSON.stringify($.tags??[]),JSON.stringify([]),"","",Date.now()),Promise.resolve({id:U})}smartSearch($){let U=$.limit??10,b=this.toFtsQuery($.query),v=this.stmts.ftsSearch.all(b,U).map((_)=>({id:_.id,title:_.title,content:_.content,type:_.kind,concepts:RJ(_.tags),confidence:_.confidence,files:RJ(_.files),advice:_.advice??"info"}));return Promise.resolve({lessons:v,crystals:[]})}boulderRead($){let b=this.stmts.boulderSelect.all($.directory,$.sessionID).map((z)=>({id:z.id,title:z.title,priority: ...

149 FROM skills s

150 JOIN skills_fts f ON f.rowid = (SELECT rowid FROM skills WHERE id = s.id)

151 ${

dist/mcp-server.jsView file

4|| (${X} === "string" && ${b} && ${b} == +${b} && !(${b} % 1))`).assign(W,X$._`+${b}`);return;case"boolean":z.elseIf(X$._`${b} === "false" || ${b} === 0 || ${b} === null`).assign(W... L5: || ${X} === "boolean" || ${b} === null`).assign(W,X$._`[${b}]`)}}}function _x({gen:$,parentData:v,parentDataProperty:U},z){$.if(X$._`${v} !== undefined`,()=>$.assign(X$._`${v}[${U}... L6: missingProperty: ${z}, L7: depsCount: ${v}, L8: deps: ${U}}`};var Am={keyword:"dependencies",type:"object",schemaType:"object",error:iS.error,code($){let[v,U]=Dm($);lS($,v),nS($,U)}};function Dm({schema:$}){let v={},U={};for(let... L9: `}catch{O=JSON.stringify({timestamp:W.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as p_}from"node:module";var f_=Object.create;var{getPrototypeOf:y_,defineProperty:zN,getOwnPropertyNames:m_}=Object;var c_=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new s4.Scope({parent:$}),this._nodes=[new yq]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${X} == "string" && ${b} && ${b} == +${b})`).assign(W,X$._`+${b}`);return;case"integer":z.elseIf(X$._`${X} === "boolean" || ${b} === null L4: || (${X} === "string" && ${b} && ${b} == +${b} && !(${b} % 1))`).assign(W,X$._`+${b}`);return;case"boolean":z.elseIf(X$._`${b} === "false" || ${b} === 0 || ${b} === null`).assign(W... L5: || ${X} === "boolean" || ${b} === null`).assign(W,X$._`[${b}]`)}}}function _x({gen:$,p

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

Source & flagged code

7 flagged · loading source

dist/lib.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code