registry / @herjarsa/omo-meta-governor / 0.38.2

@herjarsa/omo-meta-governor@0.38.2

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.44 MB of source, external domains: 127.0.0.1, github.com, json-schema.org, raw.githubusercontent.com, skills-library.com, skills.sh

Source & flagged code

9 flagged

dist/lib.jsView file

Lines 1-22javascript

1import{createRequire as rO}from"node:module";var uO=Object.defineProperty;var cO=($)=>$;function hO($,v){this[$]=cO.bind(null,v)}var I$=($,v)=>{for(var z in v)uO($,z,{get:v[z],enumerable:!0,configurable:!0,set:hO.bind(v,z)})};var i$=($,v)=>()=>($&&(v=$($=0)),v);var m$=rO(import.meta.url);import{spawn as nO,spawnSync as Uv}from"node:child_process";function ZJ($){try{let v=Uv("pgrep",["-P",String($)],{encoding:"utf8"});for(let z of v.stdout.trim().split(/\s+/)){let b=Number(z);if(!b)continue;ZJ(b);try{process.kill(b,"SIGKILL")}catch{}}}catch{}}function d$($){if(!$||$<=0)return;try{if(process.pla ...

2`}catch{_=JSON.stringify({timestamp:X.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

3`}try{dO(V$,_)}catch{}if($==="error")console.error(`[meta-governor] ${v}`)}function A($,v,z){DJ($,v,z)}function b9($){DJ($.level,$.message,$.data,$.event,$.sessionID)}function N9(){try{if(U4(V$))return FJ(V$).size}catch{}return 0}function J9(){let $=0;for(let v=1;v<=oU;v++)if(U4(`${V$}.${v}`))$=v;else break;return $}var sO,$9,V$,v9=10485760,oU=5;var bv=i$(()=>{sO=[/eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,/sk-(?:proj-|svc-|)[a-zA-Z0-9]{20,}/g,/pk-[a-zA-Z0-9]{20,}/g,/ghp_[a-zA-Z0-9]{36,}/g,/ghs_[a-zA-Z0-9]{36,}/g,/github_pat_[a-zA-Z0-9]{22,}/g,/Bearer\s+[a-zA-Z0-9_\-]{20,}/gi,/(?:key ...

4 const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

5 const {spawn} = require("child_process");

6 const run = () => {

7 try {

8 const c = spawn("npx", ["codegraph", "update"], {

9 cwd: ${JSON.stringify($)},

10 stdio: "ignore",

11 windowsHide: true,

12 shell: false,

13 });

14 c.unref();

15 } catch(e) { /* best effort */ }

16 };

17 run();

18 setInterval(run, 30_000);

19 `],{stdio:"ignore",detached:!0,shell:!1,env:{...process.env,OMO_MG_SPAWN:"1"}});else b=xJ("python3",["-m","graphify",".","--no-viz","--watch"],{cwd:$,stdio:"ignore",detached:!0

20`)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if(U)return U[1]}catch{}for(let v of["python","python3"])try{let b=$$(v,["-c","import urllib.request, json; d=json.load(urllib.request.urlopen('https://pypi.org/pypi/graphifyy/json')); print(d['info']['version'])"],{timeoutMs:1e4}).stdout.trim();if(b.length>0)return b}catch{}return null}async function $1($){let v=[{bin:"npx",args:["--yes","codegraph","--version"]},{bin:"node",args:["node_modules/.bin/codegraph","--version"]}];for(let{bin:z,args:b}of v)try{let U;if($){let J=$(`${z} ${b.join(" ")}`,{stdio:"ignore",timeout:1e4});U ...

22Please call the \`${v.mcpTool}\` MCP tool with EXACTLY these args:

Long lines were clipped for display.

Lines 147-187javascript

147 ORDER BY priority ASC, updated_at_ms DESC

148 `)}}saveMemory($){let v=YX("M"),z=($.concepts[0]??"memory").slice(0,80);return this.stmts.insertEntry.run(v,"memory",z,$.content,"",null,0.5,JSON.stringify($.concepts),JSON.stringify($.files??[]),"","",Date.now()),Promise.resolve({id:v})}saveLesson($){let v=YX("L"),z=$.confidence??0.5,b=($.content.split(`

149`)[0]??"lesson").slice(0,80);return this.stmts.insertEntry.run(v,"lesson",b,$.content,$.context,null,z,JSON.stringify($.tags??[]),JSON.stringify([]),"","",Date.now()),Promise.resolve({id:v})}smartSearch($){let v=$.limit??10,z=this.toFtsQuery($.query),U=this.stmts.ftsSearch.all(z,v).map((N)=>({id:N.id,title:N.title,content:N.content,type:N.kind,concepts:WX(N.tags),confidence:N.confidence,files:WX(N.files),advice:N.advice??"info"}));return Promise.resolve({lessons:U,crystals:[]})}boulderRead($){let z=this.stmts.boulderSelect.all($.directory,$.sessionID).map((b)=>({id:b.id,title:b.title,priority: ...

150 FROM skills s

151 JOIN skills_fts f ON f.rowid = (SELECT rowid FROM skills WHERE id = s.id)

152 ${

dist/mcp-server.jsView file

4|| (${Q} === "string" && ${z} && ${z} == +${z} && !(${z} % 1))`).assign(Y,c._`+${z}`);return;case"boolean":X.elseIf(c._`${z} === "false" || ${z} === 0 || ${z} === null`).assign(Y,!... L5: || ${Q} === "boolean" || ${z} === null`).assign(Y,c._`[${z}]`)}}}function FF({gen:$,parentData:U,parentDataProperty:J},X){$.if(c._`${U} !== undefined`,()=>$.assign(c._`${U}[${J}]`,... L6: missingProperty: ${X}, L7: depsCount: ${U}, L8: deps: ${J}}`};var NP={keyword:"dependencies",type:"object",schemaType:"object",error:HO.error,code($){let[U,J]=OP($);OO($,U),BO($,J)}};function OP({schema:$}){let U={},J={};for(let... L9: `}catch{b=JSON.stringify({timestamp:Y.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as ow}from"node:module";var hw=Object.create;var{getPrototypeOf:uw,defineProperty:u9,getOwnPropertyNames:mw}=Object;var lw=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new Y6.Scope({parent:$}),this._nodes=[new b3]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${Q} == "string" && ${z} && ${z} == +${z})`).assign(Y,c._`+${z}`);return;case"integer":X.elseIf(c._`${Q} === "boolean" || ${z} === null L4: || (${Q} === "string" && ${z} && ${z} == +${z} && !(${z} % 1))`).assign(Y,c._`+${z}`);return;case"boolean":X.elseIf(c._`${z} === "false" || ${z} === 0 || ${z} === null`).assign(Y,!... L5: || ${Q} === "boolean" || ${z} === null`).assign(Y,c._`[${z}]`)}}}function FF({gen:$,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 131389 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 131389 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

Source & flagged code

9 flagged · loading source

dist/lib.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code