oh-my-claude-sisyphus@5.6.0
Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource supports an explicit-user-command agent configuration warning under the supplied policy. No concrete malicious behavior justifies blocking publication.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs omc setup; silent updates additionally require an enabled saved preference.
Impact
Package code gains configured execution within later agent sessions; enabled silent updates can change installed code without another confirmation.
Mechanism
The installer merges package hooks into agent settings and persists the resulting configuration.
AI rationale
Source supports an explicit-user-command agent configuration warning under the supplied policy. No concrete malicious behavior justifies blocking publication.
Evidence
bridge/cli.cjsdist/features/auto-update.jssettings.json
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- bridge/cli.cjs exposes an explicit setup command that invokes the installer.
- The installer merges OMC hooks and writes Claude Code settings.json in the configured agent directory.
- dist/features/auto-update.js disables silent updates by default; enabling the saved preference permits later updates without confirmation.
Evidence against
- package.json has no preinstall, install, or postinstall hook and no runtime self-dependency.
- Inspected source did not establish credential theft, covert exfiltration, or malicious install-time mutation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
24 flaggeddist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
bridge/cli.cjsView file
43* Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L969: var EventEmitter = require("node:events").EventEmitter;
L970: var childProcess = require("node:child_process");
L971: var path27 = require("node:path");
...
L1018: this._outputConfiguration = {
L1019: writeOut: (str) => process3.stdout.write(str),
L1020: writeErr: (str) => process3.stderr.write(str),
...
L1054: * @returns {Command[]}
L1055: * @private
L1056: */
Findings
3 Critical16 High7 Medium6 Low
CriticalCredential Exfiltrationbridge/cli.cjs
CriticalRemote Response Code Executionbridge/cli.cjs
CriticalTrigger Reachable Dangerous Capabilitybridge/cli.cjs
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighEvalbridge/cli.cjs
HighEntrypoint Build Divergencebridge/cli.cjs
HighSame File Env Network Executionscripts/release-boundary.mjs#virtual:normalized:round1
HighCredential Redirect Persistencebridge/cli.cjs
HighCommand Output Exfiltrationbridge/cli.cjs
HighHidden Inline Dependency Executionbridge/cli.cjs
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@5.6.0.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@5.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.