registry / @herjarsa/omo-meta-governor / 0.35.4

@herjarsa/omo-meta-governor@0.35.4

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The inspected code shows a guarded, first-party skill installation capability rather than a concrete attack, warranting a warning under the agent-extension lifecycle policy. The required archive is non-UTF-8 and unresolved, so this review cannot mark the package clean.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

An MCP caller invokes `omo_skill_add` and supplies `confirm=true`.

Impact

A confirmed request can install an agent skill. The inspected code does not establish secret theft or an unconsented install-hook attack.

Mechanism

The handler invokes `npx skills add` with the caller-provided skill ID; catalog synchronization can also run at server startup when enabled.

AI rationale

Evidence

dist/mcp-server.js

Network endpoints2

skills-library.comskills.sh

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The MCP server exposes an explicit skill-add operation that requires `confirm=true` before running `npx skills add` for the requested skill.
When the MCP server starts, it may sync the skill catalog if `skillHub.enabled` is true; this fetch is separate from installing a skill.
`omo_skill_get` fetches skill content from `skills.sh` by the supplied skill ID.
The package entrypoint is `dist/index.js`; `dist/lib.js` also contains the same plan-detection and completion-marker logic at the requested location.

Evidence against

The manifest has no install lifecycle hooks; it declares a main entrypoint and an MCP server binary.
The inspected network paths are skill catalog/search/download functions, not a demonstrated credential or command-output exfiltration path.
The skill installation path requires explicit confirmation before invoking the installer.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

Source & flagged code

9 flagged

dist/lib.jsView file

1import{createRequire as FK}from"node:module";var ZK=Object.defineProperty;var MK=($)=>$;function EK($,v){this[$]=MK.bind(null,v)}var L$=($,v)=>{for(var b in v)ZK($,b,{get:v[b],enum... L2: `}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

2`}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+` L3: `}try{SK(k$,X)}catch{}if($==="error")console.error(`[meta-governor] ${v}`)}function P($,v,b){AJ($,v,b)}function nK($){AJ($.level,$.message,$.data,$.event,$.sessionID)}function iK()... L4: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

167content_hash = excluded.content_hash L168: `).run($.id,$.name,$.description,$.repo_url,$.installs??0,$.skill_id,$.download_count??0,$.last_synced??v,$.content_hash),Promise.resolve($.id)}setSkillMaterializedAt($,v){this.db.... L169: `)}var Mv=($)=>(v,b,z,U)=>{let N=z?Object.assign(z,{async:!1}):{async:!1},J=v._zod.run({value:b,issues:[]},N);if(J instanceof Promise)throw new R$;if(J.issues.length){let _=new(U?....

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L167

dist/mcp-server.jsView file

4|| (${Q} === "string" && ${J} && ${J} == +${J} && !(${J} % 1))`).assign(b,c._`+${J}`);return;case"boolean":X.elseIf(c._`${J} === "false" || ${J} === 0 || ${J} === null`).assign(b,!... L5: || ${Q} === "boolean" || ${J} === null`).assign(b,c._`[${J}]`)}}}function YD({gen:$,parentData:U,parentDataProperty:z},X){$.if(c._`${U} !== undefined`,()=>$.assign(c._`${U}[${z}]`,... L6: missingProperty: ${X}, L7: depsCount: ${U}, L8: deps: ${z}}`};var UP={keyword:"dependencies",type:"object",schemaType:"object",error:wN.error,code($){let[U,z]=JP($);HN($,U),KN($,z)}};function JP({schema:$}){let U={},z={};for(let... L9: `}catch{Y=JSON.stringify({timestamp:b.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as CK}from"node:module";var FK=Object.create;var{getPrototypeOf:SK,defineProperty:C9,getOwnPropertyNames:MK}=Object;var EK=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new Y6.Scope({parent:$}),this._nodes=[new U3]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${Q} == "string" && ${J} && ${J} == +${J})`).assign(b,c._`+${J}`);return;case"integer":X.elseIf(c._`${Q} === "boolean" || ${J} === null L4: || (${Q} === "string" && ${J} && ${J} == +${J} && !(${J} % 1))`).assign(b,c._`+${J}`);return;case"boolean":X.elseIf(c._`${J} === "false" || ${J} === 0 || ${J} === null`).assign(b,!... L5: || ${Q} === "boolean" || ${J} === null`).assign(b,c._`[${J}]`)}}}function YD({gen:$,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 131389 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 131389 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

Source & flagged code

9 flagged · loading source

dist/lib.jsView file

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

Low

Findings

7 High4 Medium4 Low

HighChild Processdist/lib.js

HighSame File Env Network Executiondist/mcp-server.js

HighCommand Output Exfiltrationdist/mcp-server.js

HighTrigger Reachable Command Output Exfiltrationdist/mcp-server.js

HighRuntime Package Installdist/lib.js

HighShips High Entropy Blobdist/skills/chore.tar.gz

HighKnown Malware Source Similaritydist/mcp-server.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobdist/skills/chore.tar.gz

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/lib.js

Affected versions and remediation

This report applies to @herjarsa/omo-meta-governor@0.35.4.

See all versions of @herjarsa/omo-meta-governor for other recorded verdicts.

Review the evidence and your use of @herjarsa/omo-meta-governor@0.35.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 22:07:21.927Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.