registry / oh-my-claude-sisyphus / 5.5.0
oh-my-claude-sisyphus@5.5.0
Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package contains a configuration-gated, automatic self-update capability invoked by an AI-agent session hook. It warrants a warning for guarded agent-extension lifecycle risk, not a block, because the path is opt-in and no concrete exfiltration or install-hook abuse was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Starting a Claude Code session after silentAutoUpdate has been enabled in the package configuration.
Impact
An enabled installation can change the globally installed package during an agent session, creating a guarded extension lifecycle risk.
Mechanism
The hook calls the updater, which checks the package GitHub release endpoint and can run a global npm install of the latest package without confirmation.
AI rationale
The package contains a configuration-gated, automatic self-update capability invoked by an AI-agent session hook. It warrants a warning for guarded agent-extension lifecycle risk, not a block, because the path is opt-in and no concrete exfiltration or install-hook abuse was found.
Evidence
dist/hooks/bridge.jsdist/features/auto-update.js
Network endpoints1
api.github.com/repos/Yeachan-Heo/oh-my-claudecode/releases/latest
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A session-start hook loads and invokes the silent update initializer.
- The silent updater is disabled unless configuration enables it, but when enabled it defaults to automatically applying updates without confirmation.
- The update operation runs a global npm install of the same package at latest.
- Package metadata has no preinstall, install, or postinstall lifecycle hook.
Evidence against
- The automatic update path is configuration-gated and defaults to disabled.
- The observed network request is directed to the package's GitHub release API.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
25 flaggeddist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
bridge/cli.cjsView file
43* Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L969: var EventEmitter = require("node:events").EventEmitter;
L970: var childProcess = require("node:child_process");
L971: var path27 = require("node:path");
...
L1018: this._outputConfiguration = {
L1019: writeOut: (str) => process3.stdout.write(str),
L1020: writeErr: (str) => process3.stderr.write(str),
...
L1054: * @returns {Command[]}
L1055: * @private
L1056: */
Findings
4 Critical16 High7 Medium6 Low
CriticalCredential Exfiltrationbridge/cli.cjs
CriticalRemote Response Code Executionbridge/cli.cjs
CriticalTrigger Reachable Dangerous Capabilitybridge/cli.cjs
CriticalPrevious Version Dangerous Deltadist/lib/mode-state-io.js
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighEvalbridge/cli.cjs
HighEntrypoint Build Divergencebridge/cli.cjs
HighSame File Env Network Executionscripts/release-boundary.mjs#virtual:normalized:round1
HighCredential Redirect Persistencebridge/cli.cjs
HighCommand Output Exfiltrationbridge/cli.cjs
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@5.5.0.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@5.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.