registry / oh-my-claude-sisyphus / 4.15.10
oh-my-claude-sisyphus@4.15.10
Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner's claimed default credential exfiltration is not supported by the source: network calls are configured notification/update features and the daemon uses an environment allowlist. The remaining extension lifecycle and remote-control capability warrants a warning, not a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running omc, its update command, or explicitly enabled notification/auto-update features.
Impact
Changes Claude runtime state and can execute configured updates or relay configured remote replies to an active tmux pane.
Mechanism
First-party Claude extension setup, opt-in self-update, and configured notification bridge.
AI rationale
The scanner's claimed default credential exfiltration is not supported by the source: network calls are configured notification/update features and the daemon uses an environment allowlist. The remaining extension lifecycle and remote-control capability warrants a warning, not a block.
Evidence
package.jsondist/features/auto-update.jsdist/cli/launch.jsdist/notifications/reply-listener.jsdist/notifications/dispatcher.jsskills/project-session-manager/tests/test-jira-provider.sh~/.claude/.omc-launch~/.claude/.credentials.json~/.claude/.omc-silent-update.json~/.claude/.omc-update.log
Network endpoints5
api.github.com/repos/Yeachan-Heo/oh-my-claudecoderaw.githubusercontent.com/Yeachan-Heo/oh-my-claudecodediscord.com/api/v10api.telegram.orghooks.slack.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Runtime update runs global npm install and reconciles Claude artifacts.
- CLI launch creates a scoped .omc-launch Claude runtime and links credentials.
- Reply listener can inject configured Discord/Telegram/Slack replies into tmux.
- Silent auto-update can apply updates after explicit configuration.
Evidence against
- package.json has no preinstall/install/postinstall hook.
- Release checks target the declared GitHub repository.
- Silent auto-update defaults disabled without configuration.
- Notification endpoints and tokens are configuration-dependent; no package-owned exfil receiver found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
15 flaggeddist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
bridge/mcp-server.cjsView file
2955sourceCode = this.opts.code.process(sourceCode, sch);
L2956: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L2957: const validate = makeValidate(this, this.scope.get());
Low
Eval
Package source references a known benign dynamic code generation pattern.
Findings
2 Critical7 High7 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationdist/notifications/reply-listener.js
CriticalPrevious Version Dangerous Deltadist/cli/launch.js
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighSame File Env Network Executionscripts/release-boundary.mjs#virtual:normalized:round1
HighSandbox Evasion Gated Capabilitydist/tools/lsp/servers.js
HighCloud Metadata Accessbridge/runtime-cli.cjs
HighRuntime Package Installdist/features/auto-update.js
HighPayload In Excluded Dirskills/project-session-manager/tests/test-jira-provider.sh
MediumDynamic Requiredist/tools/ast-tools.js
Medium
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@4.15.10.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@4.15.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.