registry / @herjarsa/omo-meta-governor / 0.35.0

@herjarsa/omo-meta-governor@0.35.0

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.76 MB of source, external domains: 127.0.0.1, github.com, json-schema.org, raw.githubusercontent.com, skills-library.com, skills.sh

Source & flagged code

9 flagged

dist/lib.jsView file

Lines 1-22javascript

1import{createRequire as SK}from"node:module";var{defineProperty:hU,getOwnPropertyNames:PK,getOwnPropertyDescriptor:ZK}=Object,MK=Object.prototype.hasOwnProperty;function EK($){return this[$]}var FK=($)=>{var v=(qJ??=new WeakMap).get($),b;if(v)return v;if(v=hU({},"__esModule",{value:!0}),$&&typeof $==="object"||typeof $==="function"){for(var z of PK($))if(!MK.call(v,z))hU(v,z,{get:EK.bind($,z),enumerable:!(b=ZK($,z))||b.enumerable})}return qJ.set($,v),v},qJ;var DK=($)=>$;function xK($,v){this[$]=DK.bind(null,v)}var B$=($,v)=>{for(var b in v)hU($,b,{get:v[b],enumerable:!0,configurable:!0,set:xK. ...

2`}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

3`}try{CK(Y$,X)}catch{}if($==="error")console.error(`[meta-governor] ${v}`)}function P($,v,b){AJ($,v,b)}function dK($){AJ($.level,$.message,$.data,$.event,$.sessionID)}function oK(){try{if(s6(Y$))return HJ(Y$).size}catch{}return 0}function pK(){let $=0;for(let v=1;v<=lU;v++)if(s6(`${Y$}.${v}`))$=v;else break;return $}var rK,hK,Y$,nK=10485760,lU=5;var dv=s$(()=>{rK=[/eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,/sk-(?:proj-|svc-|)[a-zA-Z0-9]{20,}/g,/pk-[a-zA-Z0-9]{20,}/g,/ghp_[a-zA-Z0-9]{36,}/g,/ghs_[a-zA-Z0-9]{36,}/g,/github_pat_[a-zA-Z0-9]{22,}/g,/Bearer\s+[a-zA-Z0-9_\-]{20,}/gi,/(?:key ...

4 const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

5 const {spawn} = require("child_process");

6 const run = () => {

7 try {

8 const c = spawn("npx", ["codegraph", "update"], {

9 cwd: ${JSON.stringify($)},

10 stdio: "ignore",

11 windowsHide: true,

12 shell: false,

13 });

14 c.unref();

15 } catch(e) { /* best effort */ }

16 };

17 run();

18 setInterval(run, 30_000);

19 `],{stdio:"ignore",detached:!0,shell:!1,env:{...process.env,OMO_MG_SPAWN:"1"}});else z=PJ("python3",["-m","graphify",".","--no-viz"

20`)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if(U)return U[1]}catch{}for(let v of["python","python3"])try{let z=$$(v,["-c","import urllib.request, json; d=json.load(urllib.request.urlopen('https://pypi.org/pypi/graphifyy/json')); print(d['info']['version'])"],{timeoutMs:1e4}).stdout.trim();if(z.length>0)return z}catch{}return null}async function sU($){let v=[{bin:"npx",args:["--yes","codegraph","--version"]},{bin:"node",args:["node_modules/.bin/codegraph","--version"]}];for(let{bin:b,args:z}of v)try{let U;if($){let J=$(`${b} ${z.join(" ")}`,{stdio:"ignore",timeout:1e4});U ...

22Please call the \`${v.mcpTool}\` MCP tool with EXACTLY these args:

Long lines were clipped for display.

Lines 147-187javascript

147 ORDER BY priority ASC, updated_at_ms DESC

148 `)}}saveMemory($){let v=J_("M"),b=($.concepts[0]??"memory").slice(0,80);return this.stmts.insertEntry.run(v,"memory",b,$.content,"",null,0.5,JSON.stringify($.concepts),JSON.stringify($.files??[]),"","",Date.now()),Promise.resolve({id:v})}saveLesson($){let v=J_("L"),b=$.confidence??0.5,z=($.content.split(`

149`)[0]??"lesson").slice(0,80);return this.stmts.insertEntry.run(v,"lesson",z,$.content,$.context,null,b,JSON.stringify($.tags??[]),JSON.stringify([]),"","",Date.now()),Promise.resolve({id:v})}smartSearch($){let v=$.limit??10,b=this.toFtsQuery($.query),U=this.stmts.ftsSearch.all(b,v).map((N)=>({id:N.id,title:N.title,content:N.content,type:N.kind,concepts:__(N.tags),confidence:N.confidence,files:__(N.files),advice:N.advice??"info"}));return Promise.resolve({lessons:U,crystals:[]})}boulderRead($){let b=this.stmts.boulderSelect.all($.directory,$.sessionID).map((z)=>({id:z.id,title:z.title,priority: ...

150 FROM skills s

151 JOIN skills_fts f ON f.rowid = (SELECT rowid FROM skills WHERE id = s.id)

152 ${

dist/mcp-server.jsView file

4|| (${X} === "string" && ${b} && ${b} == +${b} && !(${b} % 1))`).assign(w,X$._`+${b}`);return;case"boolean":z.elseIf(X$._`${b} === "false" || ${b} === 0 || ${b} === null`).assign(w... L5: || ${X} === "boolean" || ${b} === null`).assign(w,X$._`[${b}]`)}}}function Tx({gen:$,parentData:v,parentDataProperty:U},z){$.if(X$._`${v} !== undefined`,()=>$.assign(X$._`${v}[${U}... L6: missingProperty: ${z}, L7: depsCount: ${v}, L8: deps: ${U}}`};var Vm={keyword:"dependencies",type:"object",schemaType:"object",error:pS.error,code($){let[v,U]=Sm($);iS($,v),oS($,U)}};function Sm({schema:$}){let v={},U={};for(let... L9: `}catch{W=JSON.stringify({timestamp:w.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as s_}from"node:module";var l_=Object.create;var{getPrototypeOf:n_,defineProperty:zO,getOwnPropertyNames:i_}=Object;var o_=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new s6.Scope({parent:$}),this._nodes=[new cq]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${X} == "string" && ${b} && ${b} == +${b})`).assign(w,X$._`+${b}`);return;case"integer":z.elseIf(X$._`${X} === "boolean" || ${b} === null L4: || (${X} === "string" && ${b} && ${b} == +${b} && !(${b} % 1))`).assign(w,X$._`+${b}`);return;case"boolean":z.elseIf(X$._`${b} === "false" || ${b} === 0 || ${b} === null`).assign(w... L5: || ${X} === "boolean" || ${b} === null`).assign(w,X$._`[${b}]`)}}}function Tx({gen:$,p

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 131389 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 131389 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

Source & flagged code

9 flagged · loading source

dist/lib.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code