registry / oh-my-claude-sisyphus / 5.0.1
oh-my-claude-sisyphus@5.0.1
Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection found an opt-in self-update and first-party Claude plugin reconciliation path, but no unconsented install-time mutation, data exfiltration, remote payload execution, or broad foreign-agent control-surface overwrite. The static malicious label is not supported by the inspected source.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs the update command, or has explicitly enabled silent auto-updates.
Impact
A later package release can be installed and the package's own Claude plugin files and registry metadata can be refreshed.
Mechanism
Opt-in package self-update and first-party Claude plugin cache reconciliation.
AI rationale
Source inspection found an opt-in self-update and first-party Claude plugin reconciliation path, but no unconsented install-time mutation, data exfiltration, remote payload execution, or broad foreign-agent control-surface overwrite. The static malicious label is not supported by the inspected source.
Evidence
package.jsondist/features/auto-update.jsdist/features/rate-limit-wait/daemon.jsdist/tools/ast-tools.jsbin/oh-my-claudecode.jsskills/project-session-manager/tests/test-jira-provider.sh~/.claude/plugins/installed_plugins.json~/.claude/plugins/cache/omc/oh-my-claudecode~/.claude/.omc-version.json~/.claude/.omc-silent-update.json
Network endpoints2
api.github.com/repos/Yeachan-Heo/oh-my-claudecoderaw.githubusercontent.com/Yeachan-Heo/oh-my-claudecode
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The update command installs the latest package globally and then refreshes its Claude plugin cache.
- The updater changes only registry entries whose plugin ID is this package's own OMC plugin.
- Silent updating can run without interaction, but only after the user has enabled it in the package configuration.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Release checks target the package's declared GitHub repository.
- The credential token is used as GitHub API authorization, not sent to an unrelated endpoint.
- The daemon uses an explicit environment allowlist intended to exclude tokens and credentials.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
15 flaggeddist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
bridge/mcp-server.cjsView file
2955sourceCode = this.opts.code.process(sourceCode, sch);
L2956: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L2957: const validate = makeValidate(this, this.scope.get());
Low
Eval
Package source references a known benign dynamic code generation pattern.
Findings
1 Critical8 High7 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/features/rate-limit-wait/daemon.js
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighSame File Env Network Executionscripts/release-boundary.mjs#virtual:normalized:round1
HighEntrypoint Foreign Package Code Overwritedist/features/auto-update.js
HighSandbox Evasion Gated Capabilitydist/tools/lsp/servers.js
HighCloud Metadata Accessbridge/runtime-cli.cjs
HighRuntime Package Installdist/features/auto-update.js
HighPayload In Excluded Dirskills/project-session-manager/tests/test-jira-provider.sh
MediumDynamic Requiredist/tools/ast-tools.js
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@5.0.1.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@5.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.