registry / @herjarsa/omo-meta-governor / 0.35.5

@herjarsa/omo-meta-governor@0.35.5

⚠ Under review

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The inspected agent helpers perform local plan checks, and skill installation is gated by explicit confirmation. The required archive could not be reviewed as source, so the package remains unresolved and requires manual review.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A caller invokes the skill-install operation and sets confirm=true.

Impact

The requested skill may be added to the user's environment; the install hook and inspected helpers did not establish a concealed attack.

Mechanism

The operation runs npx skills add with the requested skill identifier.

AI rationale

Evidence

dist/mcp-server.js

Decision evidence

public snapshot

AI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest lists build and test scripts, with no install lifecycle hook.
The indicated agent-configuration locations in dist/index.js and dist/lib.js contain the same local AGENTS.md plan check and completion-marker helper.
The MCP skill installer requires confirm=true before running the package-install command.
The package includes dist/skills/chore.tar.gz, whose contents were not verifiable as UTF-8 source.

Evidence against

The MCP server exposes a skill-install operation that runs npx skills add after confirmation.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.41 MB of source, external domains: 127.0.0.1, github.com, json-schema.org, pypi.org, raw.githubusercontent.com, skills-library.com, skills.sh

Source & flagged code

9 flagged

dist/lib.jsView file

1import{createRequire as FK}from"node:module";var ZK=Object.defineProperty;var MK=($)=>$;function EK($,v){this[$]=MK.bind(null,v)}var L$=($,v)=>{for(var b in v)ZK($,b,{get:v[b],enum... L2: `}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

2`}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+` L3: `}try{SK(k$,X)}catch{}if($==="error")console.error(`[meta-governor] ${v}`)}function P($,v,b){AJ($,v,b)}function nK($){AJ($.level,$.message,$.data,$.event,$.sessionID)}function iK()... L4: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

167content_hash = excluded.content_hash L168: `).run($.id,$.name,$.description,$.repo_url,$.installs??0,$.skill_id,$.download_count??0,$.last_synced??v,$.content_hash),Promise.resolve($.id)}setSkillMaterializedAt($,v){this.db.... L169: `)}var Mv=($)=>(v,b,z,U)=>{let N=z?Object.assign(z,{async:!1}):{async:!1},J=v._zod.run({value:b,issues:[]},N);if(J instanceof Promise)throw new R$;if(J.issues.length){let _=new(U?....

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L167

dist/mcp-server.jsView file

4|| (${Q} === "string" && ${J} && ${J} == +${J} && !(${J} % 1))`).assign(b,c._`+${J}`);return;case"boolean":X.elseIf(c._`${J} === "false" || ${J} === 0 || ${J} === null`).assign(b,!... L5: || ${Q} === "boolean" || ${J} === null`).assign(b,c._`[${J}]`)}}}function YD({gen:$,parentData:U,parentDataProperty:z},X){$.if(c._`${U} !== undefined`,()=>$.assign(c._`${U}[${z}]`,... L6: missingProperty: ${X}, L7: depsCount: ${U}, L8: deps: ${z}}`};var UP={keyword:"dependencies",type:"object",schemaType:"object",error:wN.error,code($){let[U,z]=JP($);HN($,U),KN($,z)}};function JP({schema:$}){let U={},z={};for(let... L9: `}catch{Y=JSON.stringify({timestamp:b.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as CK}from"node:module";var FK=Object.create;var{getPrototypeOf:SK,defineProperty:C9,getOwnPropertyNames:MK}=Object;var EK=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new Y6.Scope({parent:$}),this._nodes=[new U3]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${Q} == "string" && ${J} && ${J} == +${J})`).assign(b,c._`+${J}`);return;case"integer":X.elseIf(c._`${Q} === "boolean" || ${J} === null L4: || (${Q} === "string" && ${J} && ${J} == +${J} && !(${J} % 1))`).assign(b,c._`+${J}`);return;case"boolean":X.elseIf(c._`${J} === "false" || ${J} === 0 || ${J} === null`).assign(b,!... L5: || ${Q} === "boolean" || ${J} === null`).assign(b,c._`[${J}]`)}}}function YD({gen:$,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 131389 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 131389 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

Source & flagged code

9 flagged · loading source

dist/lib.jsView file

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

Low

Findings

7 High4 Medium4 Low

HighChild Processdist/lib.js

HighSame File Env Network Executiondist/mcp-server.js

HighCommand Output Exfiltrationdist/mcp-server.js

HighTrigger Reachable Command Output Exfiltrationdist/mcp-server.js

HighRuntime Package Installdist/lib.js

HighShips High Entropy Blobdist/skills/chore.tar.gz

HighKnown Malware Source Similaritydist/mcp-server.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobdist/skills/chore.tar.gz

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/lib.js

Affected versions and remediation

This report applies to @herjarsa/omo-meta-governor@0.35.5.

See all versions of @herjarsa/omo-meta-governor for other recorded verdicts.

Review the evidence and your use of @herjarsa/omo-meta-governor@0.35.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 22:07:34.748Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.