registry / oh-my-claude-sisyphus / 5.7.1
oh-my-claude-sisyphus@5.7.1
Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
AI Security Review
scanned 23d ago · by lpm-firewall-aiThe source shows a saved opt-in gate for automatic package and first-party plugin updates, so a warning is appropriate. The inspected source did not establish an unconsented foreign-agent write or a credential attack.
Static reason
One or more suspicious static signals were detected.
Trigger
The session-start hook runs and the saved silentAutoUpdate setting is enabled.
Impact
Future Claude sessions may load the updated first-party plugin without a per-update prompt.
Mechanism
The updater installs the latest package, refreshes its plugin cache, and updates this package's Claude plugin registry entry without asking again for each update.
AI rationale
The source shows a saved opt-in gate for automatic package and first-party plugin updates, so a warning is appropriate. The inspected source did not establish an unconsented foreign-agent write or a credential attack.
Evidence
dist/features/auto-update.jsdist/hooks/bridge.jsplugins/cache/omc/oh-my-claudecodeplugins/installed_plugins.json
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook skips non-macOS systems and only attempts the package's optional native build on macOS.
- A session-start hook invokes silent update checks. The saved preference defaults to disabled; when enabled, updates can apply without per-update confirmation.
- Updates install this package, sync its Claude plugin cache, and update only this package's plugin registry entry.
- The flagged installer and team paths read version or task data, or write scoped team overlays and merge metadata; they do not establish broad foreign-agent configuration changes.
- The remaining inspected paths show package-specific release checks, language-server discovery, worktree setup, a direct-entry runtime CLI, and a Jira test stub.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
24 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall-contained-fs.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
Findings
1 Critical17 High8 Medium6 Low
CriticalRemote Response Code Executionbridge/cli.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighEvalbridge/cli.cjs
HighEntrypoint Build Divergencebridge/cli.cjs
HighSame File Env Network Executionscripts/release-boundary.mjs#virtual:normalized:round1
HighCredential Redirect Persistencebridge/cli.cjs
HighCommand Output Exfiltrationbridge/cli.cjs
HighHidden Inline Dependency Executionbridge/cli.cjs
HighSandbox Evasion Gated Capabilitydist/tools/lsp/servers.js
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@5.7.1.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@5.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.