oh-my-claude-sisyphus@5.4.0
Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malicious install-hook abuse because npm installation does not invoke the installer. It remains a warning because explicit commands can alter an AI-agent control surface and use configured credentials for network update checks.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs omc install, omc setup, or an update command.
Impact
Claude Code settings and hooks may be changed; a configured GitHub token is sent only to GitHub for update requests.
Mechanism
Explicit agent configuration installation and authenticated update checks.
AI rationale
This is not malicious install-hook abuse because npm installation does not invoke the installer. It remains a warning because explicit commands can alter an AI-agent control surface and use configured credentials for network update checks.
Evidence
bridge/cli.cjsdist/installer/index.js~/.claude/settings.json~/.claude/.omc-config.json~/.claude/hooks/
Network endpoints2
api.github.comraw.githubusercontent.com
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI exposes an explicit install command that targets the Claude Code configuration directory.
- The installer reads and modifies its settings file, which can change Claude Code hooks and configuration.
- The update feature optionally sends a user-provided GitHub token to GitHub release endpoints.
Evidence against
- package.json has no npm preinstall, install, or postinstall lifecycle hook; its only publish lifecycle entry is prepublishOnly.
- The install path is activated by explicit CLI commands, not package installation or import.
- The reported dynamic Function call is bundled AJV schema-validator code, not remote-response execution.
- The flagged shell file is a Jira-provider regression test that stubs a local jira command.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
Source & flagged code
25 flaggeddist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
bridge/cli.cjsView file
43* Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L969: var EventEmitter = require("node:events").EventEmitter;
L970: var childProcess = require("node:child_process");
L971: var path27 = require("node:path");
...
L1018: this._outputConfiguration = {
L1019: writeOut: (str) => process3.stdout.write(str),
L1020: writeErr: (str) => process3.stderr.write(str),
...
L1054: * @returns {Command[]}
L1055: * @private
L1056: */
Findings
4 Critical16 High7 Medium6 Low
CriticalCredential Exfiltrationbridge/cli.cjs
CriticalRemote Response Code Executionbridge/cli.cjs
CriticalTrigger Reachable Dangerous Capabilitybridge/cli.cjs
CriticalPrevious Version Dangerous Deltadist/installer/index.js
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighEvalbridge/cli.cjs
HighEntrypoint Build Divergencebridge/cli.cjs
HighSame File Env Network Executionscripts/release-boundary.mjs#virtual:normalized:round1
HighCredential Redirect Persistencebridge/cli.cjs
HighCommand Output Exfiltrationbridge/cli.cjs
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@5.4.0.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@5.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.