registry / oh-my-claude-sisyphus / 5.0.0
oh-my-claude-sisyphus@5.0.0
Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource confirms an opt-in automatic self-update path and first-party plugin registry mutation. The manifest lacks install-time lifecycle hooks and inspection found no concrete exfiltration or malicious payload chain.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Claude session start after the user has enabled silentAutoUpdate, or an explicit update command
Impact
Remote package updates can change the installed OMC extension; no foreign/broad control-surface overwrite was confirmed.
Mechanism
opt-in self-update and first-party Claude plugin cache synchronization
AI rationale
Source confirms an opt-in automatic self-update path and first-party plugin registry mutation. The manifest lacks install-time lifecycle hooks and inspection found no concrete exfiltration or malicious payload chain.
Evidence
package.jsondist/hooks/bridge.jsdist/features/auto-update.jsdist/hooks/team-dispatch-hook.jsdist/tools/ast-tools.js~/.claude/plugins/installed_plugins.json~/.claude/plugins/cache/omc/oh-my-claudecode
Network endpoints2
api.github.com/repos/Yeachan-Heo/oh-my-claudecoderaw.githubusercontent.com/Yeachan-Heo/oh-my-claudecode
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Session-start hook invokes silent-update initialization.
- Opt-in silent update fetches GitHub release data and runs a global npm install.
- Update code rewrites only its own OMC plugin registry entries and cache.
Evidence against
- package.json has no preinstall/install/postinstall hook.
- Silent updates default disabled when config is absent or invalid.
- No credential harvesting or exfiltration beyond GitHub update requests was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
15 flaggeddist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
bridge/mcp-server.cjsView file
2955sourceCode = this.opts.code.process(sourceCode, sch);
L2956: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L2957: const validate = makeValidate(this, this.scope.get());
Low
Eval
Package source references a known benign dynamic code generation pattern.
Findings
1 Critical8 High7 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/hooks/team-dispatch-hook.js
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighSame File Env Network Executionscripts/release-boundary.mjs#virtual:normalized:round1
HighEntrypoint Foreign Package Code Overwritedist/features/auto-update.js
HighSandbox Evasion Gated Capabilitydist/tools/lsp/servers.js
HighCloud Metadata Accessbridge/runtime-cli.cjs
HighRuntime Package Installdist/features/auto-update.js
HighPayload In Excluded Dirskills/project-session-manager/tests/test-jira-provider.sh
MediumDynamic Requiredist/tools/ast-tools.js
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@5.0.0.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@5.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.