oh-my-claude-sisyphus@5.1.0
Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an explicit-user-command agent configuration mutator, which warrants a warning under the policy. The lack of an npm install lifecycle hook prevents an install-hook abuse classification.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs omc install or omc setup.
Impact
It can change the behavior of the user's Claude Code agent environment.
Mechanism
User-invoked Claude Code hook and settings installation.
AI rationale
This is an explicit-user-command agent configuration mutator, which warrants a warning under the policy. The lack of an npm install lifecycle hook prevents an install-hook abuse classification.
Evidence
bridge/cli.cjsdist/installer/index.js~/.claude/hooks/*~/.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit install command invokes an installer for the Claude Code configuration directory.
- The installer creates hook scripts and writes Claude Code settings.
- The setup command can configure hooks and other agent components.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle script; only prepublishOnly runs automatically during publishing.
- No runtime self-dependency is declared.
- The flagged Jira file is a readable regression-test shell script, not a concealed payload.
- The GitHub token is used only for the named project's release-check requests.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
25 flaggeddist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
bridge/cli.cjsView file
43* Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L969: var EventEmitter = require("node:events").EventEmitter;
L970: var childProcess = require("node:child_process");
L971: var path27 = require("node:path");
...
L1018: this._outputConfiguration = {
L1019: writeOut: (str) => process3.stdout.write(str),
L1020: writeErr: (str) => process3.stderr.write(str),
...
L1054: * @returns {Command[]}
L1055: * @private
L1056: */
Findings
4 Critical16 High7 Medium6 Low
CriticalCredential Exfiltrationbridge/cli.cjs
CriticalRemote Response Code Executionbridge/cli.cjs
CriticalTrigger Reachable Dangerous Capabilitybridge/cli.cjs
CriticalPrevious Version Dangerous Deltadist/installer/index.js
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighEvalbridge/cli.cjs
HighEntrypoint Build Divergencebridge/cli.cjs
HighSame File Env Network Executionscripts/release-boundary.mjs#virtual:normalized:round1
HighCredential Redirect Persistencebridge/cli.cjs
HighCommand Output Exfiltrationbridge/cli.cjs
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@5.1.0.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@5.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.