registry / @oas-framework/oas / 0.5.0

@oas-framework/oas@0.5.0

OAS (Open Agent Specialization) — durable souls, disposable instances, harvest-back: the oas CLI and kernel. Runtime adapters: @oas-framework/pi (pi), Claude plugin (planned)

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

Explicit `oas init`/`use`/`install`/`sync` command or OAS instance lifecycle invocation.

Impact

Can alter OAS-managed `AGENTS.md` content and run selected integration hooks within the chosen workspace.

Mechanism

User-directed agent configuration injection and lifecycle-hook dispatch.

Rationale

The package has explicit agent-control and hook-execution capabilities, warranting a warning classification under the firewall policy. Source inspection found no concrete malicious behavior or unconsented install-time mutation.

Evidence

package.jsonbin/oas.mjslib/core.mjsintegrations/oas-aweb/bin/oas-aweb.mjsintegrations/oas-jira/bin/oas-jira.mjsintegrations/oas-okf/bin/oas-okf.mjsoas-config.yamlagents/<agent>/soul/AGENTS.md~/.oas/integrations/<integration>local-agents/memory-harvest/

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`bin/oas.mjs` exposes explicit `init`, `use`, `install`, and `sync` commands that write workspace configuration and integrations.
`lib/core.mjs` reconciles configured content into agent `AGENTS.md` files.
`lib/core.mjs` runs configured lifecycle-hook strings with `execSync` during OAS instance events.
`integrations/oas-okf/bin/oas-okf.mjs` dynamically imports this package's own `lib/core.mjs` and spawns a memory-harvest agent.

Evidence against

`package.json` contains no lifecycle scripts, so install/import does not trigger these actions.
No source network client, credential harvesting, exfiltration, eval, or remote payload download was found.
Agent-file changes are scoped to the package's OAS agent workspace model and occur through explicit CLI/framework actions.
Bundled aweb/Jira hooks are integration-specific; Jira performs no network call and aweb delegates only to the user-installed `aw` CLI.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 87.3 KB of source

Source & flagged code

1 flagged

integrations/oas-okf/bin/oas-okf.mjsView file

Lines 142-182javascript

142 const metaFile = join(home, "instance.json");

143 const meta = existsSync(metaFile) ? JSON.parse(readFileSync(metaFile, "utf8")) : {};

144 const inst = instance || meta.instance;

145 const agName = process.env.OAS_AGENT || meta.agent || "agent";

146 const sDir = soulDir || join(home, "soul");

147 const context = process.env.OAS_CONTEXT || meta.repo;

148 let root = process.env.OAS_ROOT;

149 if (!root) { // walk up from home to the agents/ dir

150 let d = home;

151 while (d !== dirname(d)) { if (d.endsWith("/instances")) { root = join(d, "..", ".."); break; } d = dirname(d); }

152 root = root ? realpathSync(join(root)) : undefined;

153 // instances live at <root>/<agent>/instances/<inst> or <root>/local-agents/<agent>/instances/<inst>

154 if (root && ["local-agents", "tmp-agents"].includes(root.split("/").pop())) root = dirname(root);

155 }

156 const notesDir = join(home, "notes");

157 const skip = (why) => out({ meta: { harvestSpawn: "skipped", why } });

158 if (String(agName).startsWith("memory-harvest")) skip("self (loop guard)");

159 const notes = existsSync(notesDir) ? readdirSync(notesDir).filter((f) => f.endsWith(".md")) : [];

160 if (notes.length === 0) skip("no pending notes");

161 if (!root || !existsSync(root)) skip("no agents root found above this home");

162 if (!inst) skip("no instance identity (run from an instance home)");

163 const core = await import(pathToFileURL(join(FRAMEWORK_ROOT, "lib", "core.mjs")).href);

164 const slug = String(inst).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 30);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

integrations/oas-okf/bin/oas-okf.mjsView on unpkg · L162

165 // Debounce: one harvester per source instance at a time.

166 const harvesterHome = (base) => join(root, base, "memory-harvest", "instances", `memory-harvest-${slug}`);

167 if (["local-agents", "tmp-agents"].some((b) => existsSync(harvesterHome(b)))) skip("harvester already running for this instance");

168 let agentDef = core.findAgent(root, "memory-harvest");

169 if (!agentDef) {

170 core.upsertTmpAgent(root, { name: "memory-harvest", instructions: readFileSync(join(FRAMEWORK_ROOT, "integrations", "oas-okf", "agents", "memory-harvest.md"), "utf8") });

171 agentDef = core.findAgent(root, "memory-harvest");

172 }

173 // Harvest model: explicit okf settings win (hook env, or resolved from config

174 // when agent-initiated); else the integration's default.

175 let harvestModel = settings["harvest-model"];

176 if (!harvestModel && context) {

177 try { harvestModel = core.resolveOasConfig(context).layers?.knowledge?.settings?.["harvest-model"]; } catch { /* config unreadable: use default */ }

178 }

179 harvestModel = harvestModel || DEFAULT_HARVEST_MODEL;

180 const workDir = realpathSync(join(home, "work"));

181 // Repo-resident souls: write to the soul AS SEEN FROM THE WORK TREE, so the

182 // promotion commits onto the instance's own branch. Otherwise the canonical soul.

Source & flagged code

1 flagged · loading source

integrations/oas-okf/bin/oas-okf.mjsView file

162if (!inst) skip("no instance identity (run from an instance home)"); L163: const core = await import(pathToFileURL(join(FRAMEWORK_ROOT, "lib", "core.mjs")).href); L164: const slug = String(inst).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 30);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

integrations/oas-okf/bin/oas-okf.mjsView on unpkg · L162

Findings

2 Medium2 Low

MediumDynamic Requireintegrations/oas-okf/bin/oas-okf.mjs

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

1 flagged

integrations/oas-okf/bin/oas-okf.mjsView file

Lines 142-182javascript

142 const metaFile = join(home, "instance.json");

143 const meta = existsSync(metaFile) ? JSON.parse(readFileSync(metaFile, "utf8")) : {};

144 const inst = instance || meta.instance;

145 const agName = process.env.OAS_AGENT || meta.agent || "agent";

146 const sDir = soulDir || join(home, "soul");

147 const context = process.env.OAS_CONTEXT || meta.repo;

148 let root = process.env.OAS_ROOT;

149 if (!root) { // walk up from home to the agents/ dir

150 let d = home;

151 while (d !== dirname(d)) { if (d.endsWith("/instances")) { root = join(d, "..", ".."); break; } d = dirname(d); }

152 root = root ? realpathSync(join(root)) : undefined;

153 // instances live at <root>/<agent>/instances/<inst> or <root>/local-agents/<agent>/instances/<inst>

154 if (root && ["local-agents", "tmp-agents"].includes(root.split("/").pop())) root = dirname(root);

155 }

156 const notesDir = join(home, "notes");

157 const skip = (why) => out({ meta: { harvestSpawn: "skipped", why } });

158 if (String(agName).startsWith("memory-harvest")) skip("self (loop guard)");

159 const notes = existsSync(notesDir) ? readdirSync(notesDir).filter((f) => f.endsWith(".md")) : [];

160 if (notes.length === 0) skip("no pending notes");

161 if (!root || !existsSync(root)) skip("no agents root found above this home");

162 if (!inst) skip("no instance identity (run from an instance home)");

163 const core = await import(pathToFileURL(join(FRAMEWORK_ROOT, "lib", "core.mjs")).href);

164 const slug = String(inst).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 30);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

integrations/oas-okf/bin/oas-okf.mjsView on unpkg · L162

165 // Debounce: one harvester per source instance at a time.

166 const harvesterHome = (base) => join(root, base, "memory-harvest", "instances", `memory-harvest-${slug}`);

167 if (["local-agents", "tmp-agents"].some((b) => existsSync(harvesterHome(b)))) skip("harvester already running for this instance");

168 let agentDef = core.findAgent(root, "memory-harvest");

169 if (!agentDef) {

170 core.upsertTmpAgent(root, { name: "memory-harvest", instructions: readFileSync(join(FRAMEWORK_ROOT, "integrations", "oas-okf", "agents", "memory-harvest.md"), "utf8") });

171 agentDef = core.findAgent(root, "memory-harvest");

172 }

173 // Harvest model: explicit okf settings win (hook env, or resolved from config

174 // when agent-initiated); else the integration's default.

175 let harvestModel = settings["harvest-model"];

176 if (!harvestModel && context) {

177 try { harvestModel = core.resolveOasConfig(context).layers?.knowledge?.settings?.["harvest-model"]; } catch { /* config unreadable: use default */ }

178 }

179 harvestModel = harvestModel || DEFAULT_HARVEST_MODEL;

180 const workDir = realpathSync(join(home, "work"));

181 // Repo-resident souls: write to the soul AS SEEN FROM THE WORK TREE, so the

182 // promotion commits onto the instance's own branch. Otherwise the canonical soul.