registry / oh-my-claude-sisyphus / 5.3.0
oh-my-claude-sisyphus@5.3.0
Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a real user-invoked agent-extension setup capability that changes global Claude Code settings and hooks. It lacks an automatic registry-install trigger or confirmed malicious exfiltration chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs omc setup or config-stop-callback.
Impact
Persists OMC hooks and settings in the user's Claude configuration; configured callbacks can disclose session summaries to the chosen service.
Mechanism
User-invoked Claude Code extension setup and configured session notifications.
AI rationale
The package has a real user-invoked agent-extension setup capability that changes global Claude Code settings and hooks. It lacks an automatic registry-install trigger or confirmed malicious exfiltration chain.
Evidence
bridge/cli.cjsdist/installer/index.js~/.claude/settings.json~/.claude/agents~/.claude/hooks~/.claude/.omc-config.json
Network endpoints3
api.telegram.orgdiscord.comslack.com
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit setup command invokes an installer that writes Claude settings and hook configuration.
- The CLI can explicitly configure session-end callbacks to Telegram, Discord, Slack, or a supplied webhook.
- The flagged Jira shell file is a readable regression test with a local stub, not a hidden payload.
Evidence against
- package.json has no preinstall, install, or postinstall hook; its only publish lifecycle hook is prepublishOnly.
- No runtime dependency on this package name was found.
- No automatic credential harvesting or exfiltration path was found during package installation or import.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
24 flaggeddist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
bridge/mcp-server.cjsView file
2955sourceCode = this.opts.code.process(sourceCode, sch);
L2956: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L2957: const validate = makeValidate(this, this.scope.get());
Low
Eval
Package source references a known benign dynamic code generation pattern.
Findings
3 Critical15 High7 Medium7 Low
CriticalCredential Exfiltrationbridge/cli.cjs
CriticalTrigger Reachable Dangerous Capabilitybridge/cli.cjs
CriticalPrevious Version Dangerous Deltadist/installer/index.js
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighEntrypoint Build Divergencebridge/cli.cjs
HighSame File Env Network Executionscripts/release-boundary.mjs#virtual:normalized:round1
HighCredential Redirect Persistencebridge/cli.cjs
HighCommand Output Exfiltrationbridge/cli.cjs
HighHidden Inline Dependency Executionbridge/cli.cjs
HighSandbox Evasion Gated Capabilitydist/tools/lsp/servers.js
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@5.3.0.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@5.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.