registry / oh-my-claude-sisyphus / 4.15.9
oh-my-claude-sisyphus@4.15.9
⚠ Under reviewMulti-agent orchestration system for Claude Code - Inspired by oh-my-opencode
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 22 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsUrlStrings
Oversized source lightweight scan
bridge/cli.cjs4.10 MB file, sampled 256 KB
FilesystemChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringscode.claude.comgithub.com
Source & flagged code
14 flaggeddist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
bridge/mcp-server.cjsView file
2955sourceCode = this.opts.code.process(sourceCode, sch);
L2956: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L2957: const validate = makeValidate(this, this.scope.get());
Low
Eval
Package source references a known benign dynamic code generation pattern.
Findings
1 Critical7 High7 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/cli/launch.js
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighSame File Env Network Executionscripts/release-boundary.mjs#virtual:normalized:round1
HighSandbox Evasion Gated Capabilitydist/tools/lsp/servers.js
HighCloud Metadata Accessbridge/runtime-cli.cjs
HighRuntime Package Installdist/features/auto-update.js
HighPayload In Excluded Dirskills/project-session-manager/tests/test-jira-provider.sh
MediumDynamic Requiredist/tools/ast-tools.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@4.15.9.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@4.15.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.