registry / @herjarsa/omo-meta-governor / 0.35.6

@herjarsa/omo-meta-governor@0.35.6

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.41 MB of source, external domains: 127.0.0.1, github.com, json-schema.org, raw.githubusercontent.com, skills-library.com, skills.sh

Source & flagged code

9 flagged

dist/lib.jsView file

Lines 1-22javascript

1import{createRequire as FK}from"node:module";var ZK=Object.defineProperty;var MK=($)=>$;function EK($,v){this[$]=MK.bind(null,v)}var L$=($,v)=>{for(var b in v)ZK($,b,{get:v[b],enumerable:!0,configurable:!0,set:EK.bind(v,b)})};var vv=($,v)=>()=>($&&(v=$($=0)),v);var m$=FK(import.meta.url);import{spawn as DK,spawnSync as Uv}from"node:child_process";function BJ($){try{let v=Uv("pgrep",["-P",String($)],{encoding:"utf8"});for(let b of v.stdout.trim().split(/\s+/)){let z=Number(b);if(!z)continue;BJ(z);try{process.kill(z,"SIGKILL")}catch{}}}catch{}}function i$($){if(!$||$<=0)return;try{if(process.pla ...

2`}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

3`}try{SK(k$,X)}catch{}if($==="error")console.error(`[meta-governor] ${v}`)}function P($,v,b){AJ($,v,b)}function nK($){AJ($.level,$.message,$.data,$.event,$.sessionID)}function iK(){try{if(U4(k$))return HJ(k$).size}catch{}return 0}function lK(){let $=0;for(let v=1;v<=dU;v++)if(U4(`${k$}.${v}`))$=v;else break;return $}var fK,cK,k$,yK=10485760,dU=5;var Gv=vv(()=>{fK=[/eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,/sk-(?:proj-|svc-|)[a-zA-Z0-9]{20,}/g,/pk-[a-zA-Z0-9]{20,}/g,/ghp_[a-zA-Z0-9]{36,}/g,/ghs_[a-zA-Z0-9]{36,}/g,/github_pat_[a-zA-Z0-9]{22,}/g,/Bearer\s+[a-zA-Z0-9_\-]{20,}/gi,/(?:key ...

4 const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

5 const {spawn} = require("child_process");

6 const run = () => {

7 try {

8 const c = spawn("npx", ["codegraph", "update"], {

9 cwd: ${JSON.stringify($)},

10 stdio: "ignore",

11 windowsHide: true,

12 shell: false,

13 });

14 c.unref();

15 } catch(e) { /* best effort */ }

16 };

17 run();

18 setInterval(run, 30_000);

19 `],{stdio:"ignore",detached:!0,shell:!1,env:{...process.env,OMO_MG_SPAWN:"1"}});else z=PJ("python3",["-m","graphify",".","--no-viz","--watch"],{cwd:$,stdio:"ignore",detached:!0

20`)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if(U)return U[1]}catch{}for(let v of["python","python3"])try{let z=$$(v,["-c","import urllib.request, json; d=json.load(urllib.request.urlopen('https://pypi.org/pypi/graphifyy/json')); print(d['info']['version'])"],{timeoutMs:1e4}).stdout.trim();if(z.length>0)return z}catch{}return null}async function $b($){let v=[{bin:"npx",args:["--yes","codegraph","--version"]},{bin:"node",args:["node_modules/.bin/codegraph","--version"]}];for(let{bin:b,args:z}of v)try{let U;if($){let J=$(`${b} ${z.join(" ")}`,{stdio:"ignore",timeout:1e4});U ...

22Please call the \`${v.mcpTool}\` MCP tool with EXACTLY these args:

Long lines were clipped for display.

Lines 147-187javascript

147 ORDER BY priority ASC, updated_at_ms DESC

148 `)}}saveMemory($){let v=J_("M"),b=($.concepts[0]??"memory").slice(0,80);return this.stmts.insertEntry.run(v,"memory",b,$.content,"",null,0.5,JSON.stringify($.concepts),JSON.stringify($.files??[]),"","",Date.now()),Promise.resolve({id:v})}saveLesson($){let v=J_("L"),b=$.confidence??0.5,z=($.content.split(`

149`)[0]??"lesson").slice(0,80);return this.stmts.insertEntry.run(v,"lesson",z,$.content,$.context,null,b,JSON.stringify($.tags??[]),JSON.stringify([]),"","",Date.now()),Promise.resolve({id:v})}smartSearch($){let v=$.limit??10,b=this.toFtsQuery($.query),U=this.stmts.ftsSearch.all(b,v).map((N)=>({id:N.id,title:N.title,content:N.content,type:N.kind,concepts:__(N.tags),confidence:N.confidence,files:__(N.files),advice:N.advice??"info"}));return Promise.resolve({lessons:U,crystals:[]})}boulderRead($){let b=this.stmts.boulderSelect.all($.directory,$.sessionID).map((z)=>({id:z.id,title:z.title,priority: ...

150 FROM skills s

151 JOIN skills_fts f ON f.rowid = (SELECT rowid FROM skills WHERE id = s.id)

152 ${

dist/mcp-server.jsView file

4|| (${Q} === "string" && ${J} && ${J} == +${J} && !(${J} % 1))`).assign(b,c._`+${J}`);return;case"boolean":X.elseIf(c._`${J} === "false" || ${J} === 0 || ${J} === null`).assign(b,!... L5: || ${Q} === "boolean" || ${J} === null`).assign(b,c._`[${J}]`)}}}function YD({gen:$,parentData:U,parentDataProperty:z},X){$.if(c._`${U} !== undefined`,()=>$.assign(c._`${U}[${z}]`,... L6: missingProperty: ${X}, L7: depsCount: ${U}, L8: deps: ${z}}`};var UP={keyword:"dependencies",type:"object",schemaType:"object",error:wN.error,code($){let[U,z]=JP($);HN($,U),KN($,z)}};function JP({schema:$}){let U={},z={};for(let... L9: `}catch{Y=JSON.stringify({timestamp:b.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as CK}from"node:module";var FK=Object.create;var{getPrototypeOf:SK,defineProperty:C9,getOwnPropertyNames:MK}=Object;var EK=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new Y6.Scope({parent:$}),this._nodes=[new U3]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${Q} == "string" && ${J} && ${J} == +${J})`).assign(b,c._`+${J}`);return;case"integer":X.elseIf(c._`${Q} === "boolean" || ${J} === null L4: || (${Q} === "string" && ${J} && ${J} == +${J} && !(${J} % 1))`).assign(b,c._`+${J}`);return;case"boolean":X.elseIf(c._`${J} === "false" || ${J} === 0 || ${J} === null`).assign(b,!... L5: || ${Q} === "boolean" || ${J} === null`).assign(b,c._`[${J}]`)}}}function YD({gen:$,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 131389 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 131389 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

Source & flagged code

9 flagged · loading source

dist/lib.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code