oh-my-claude-sisyphus@5.7.24
Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
AI Security Review
scanned 4d ago · by lpm-firewall-aiJev is opt-in and has no identified install-time data collection, but enabled judgments transmit user prompts and other agent context to api.typesafe.ai without clearly describing those payload fields. This is a disclosure risk, so warn rather than block.
Static reason
One or more suspicious static signals were detected.
Trigger
A user configures TYPESAFE_API_KEY and enables one or more points with OMC_JEV.
Impact
Potentially sensitive prompt, task, or message fragments reach the service. The package documents enabling Jev and its default zero-egress behavior, but does not clearly enumerate the content sent.
Mechanism
The resolver bounds state excerpts and posts them with judgment questions to https://api.typesafe.ai/v1/systemone, authenticating with the configured Typesafe key. Shadow results may also be written to state/jev/shadow.jsonl.
AI rationale
Jev is opt-in and has no identified install-time data collection, but enabled judgments transmit user prompts and other agent context to api.typesafe.ai without clearly describing those payload fields. This is a disclosure risk, so warn rather than block.
Evidence
dist/hooks/jev/config.jsdist/hooks/jev/resolver.jsdist/hooks/jev/client.jsdist/hooks/keyword-detector/jev-shadow.jsdist/hooks/learner/jev-shadow.jsstate/jev/shadow.jsonl
Network endpoints1
api.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Jev requires explicit TYPESAFE_API_KEY and OMC_JEV configuration; its config documents per-point opt-in and no egress when unset.
- Enabled prompt judgments include the submitted user prompt in the state sent to the resolver.
- Other judgment states can include delegated task prompts and assistant or user messages.
- The resolver posts state and questions to api.typesafe.ai using the configured Typesafe key; the README describes Jev queries but does not specify that these content fields are sent.
- The postinstall hook only attempts an optional local native build on macOS when the binary is absent.
Evidence against
- The content transfer requires explicit Jev configuration; the package documents zero egress by default.
- Sending task context to Jev supports the package’s optional remote judgment feature, and the resolver bounds each string excerpt.
- The postinstall hook has no identified network or unrelated data collection behavior.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
23 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall-contained-fs.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
Findings
16 High8 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighEntrypoint Build Divergencebridge/cli.cjs
HighSame File Env Network Executionscripts/release-boundary.mjs#virtual:normalized:round1
HighCredential Redirect Persistencebridge/cli.cjs
HighCommand Output Exfiltrationbridge/cli.cjs
HighHidden Inline Dependency Executionbridge/cli.cjs
HighSandbox Evasion Gated Capabilitydist/tools/lsp/servers.js
HighCloud Metadata Accessbridge/runtime-cli.cjs
HighCopied Package Dependency Bridgebridge/cli.cjs
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@5.7.24.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@5.7.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.