registry / oh-my-hi / 0.15.0

oh-my-hi@0.15.0

Oh, so that's what your coding agents have been doing! — Claude Code & Codex harness insights dashboard

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 725 KB of source, external domains: 127.0.0.1, api.github.com, code.claude.com, developers.openai.com, docs.anthropic.com, github.com, platform.claude.com, registry.npmjs.org, www.anthropic.com, www.w3.org

Source & flagged code

8 flagged

package.jsonView file

Lines 6-35json

6 "type": "git",

7 "url": "https://github.com/netil/oh-my-hi.git"

8 },

9 "author": "Jae Sung Park <alberto.park@gmail.com>",

10 "license": "MIT",

11 "bin": {

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/oh-my-hi.mjsView file

11// independent of how this launcher was invoked. L12: import { spawn } from 'child_process'; L13: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/oh-my-hi.mjsView on unpkg · L11

scripts/serve.mjsView file

413if (process.platform === 'darwin') execSync(`open "${launchUrl}"`); L414: else if (process.platform === 'win32') execSync(`start "" "${launchUrl}"`, { shell: true }); L415: else execSync(`xdg-open "${launchUrl}"`);

High

Shell

Package source references shell execution.

scripts/serve.mjsView on unpkg · L413

12L13: import http from 'http'; L14: import fs from 'fs'; L15: import path from 'path'; L16: import { execSync, spawnSync } from 'child_process'; L17: import { fileURLToPath } from 'url'; ... L25: // OMH_OUTPUT_DIR override matches generate-dashboard.mjs (also used by tests). L26: const OUTPUT_DIR = process.env.OMH_OUTPUT_DIR || path.join(ROOT, 'output'); L27: const LEGACY_DB_PATH = path.join(OUTPUT_DIR, 'oh-my-hi.sqlite');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/serve.mjsView on unpkg · L12

scripts/generate-dashboard.mjsView file

23import fs from 'fs'; L24: import { execSync, spawnSync, spawn } from 'child_process'; L25: ... L57: const __filename = fileURLToPath(import.meta.url); L58: const __dirname = path.dirname(__filename); L59: const ROOT = path.resolve(__dirname, '..'); L60: const TEMPLATES = path.join(ROOT, 'templates'); L61: const OUTPUT = process.env.OMH_OUTPUT_DIR || path.join(ROOT, 'output'); L62: ... L64: // Dev build: script is running from the source git checkout (the folder L65: // with .git and package.json name === "oh-my-hi"). Always L66: // rebuilds HTML from templates (skips mtime short-circuit),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/generate-dashboard.mjsView on unpkg · L23

23Cross-file remote execution chain: scripts/generate-dashboard.mjs spawns templates/app.js; helper contains network access plus dynamic code execution. L23: import fs from 'fs'; L24: import { execSync, spawnSync, spawn } from 'child_process'; L25: ... L57: const __filename = fileURLToPath(import.meta.url); L58: const __dirname = path.dirname(__filename); L59: const ROOT = path.resolve(__dirname, '..'); L60: const TEMPLATES = path.join(ROOT, 'templates'); L61: const OUTPUT = process.env.OMH_OUTPUT_DIR || path.join(ROOT, 'output'); L62: ... L64: // Dev build: script is running from the source git checkout (the folder L65: // with .git and package.json name === "oh-my-hi"). Always L66: // rebuilds HTML from templates (skips mtime short-circuit),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/generate-dashboard.mjsView on unpkg · L23

30console.log('oh-my-hi: installing dependencies...'); L31: execSync('npm install --omit=dev', { cwd: __boot_root, stdio: 'inherit' }); L32: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/generate-dashboard.mjsView on unpkg · L30

Findings

7 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/oh-my-hi.mjs

HighShellscripts/serve.mjs

HighSame File Env Network Executionscripts/serve.mjs

HighSandbox Evasion Gated Capabilityscripts/generate-dashboard.mjs

HighCross File Remote Execution Contextscripts/generate-dashboard.mjs

HighRuntime Package Installscripts/generate-dashboard.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

bin/oh-my-hi.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// bin/oh-my-hi.mjs — standalone CLI entry point.

3//

4// Lets the dashboard run WITHOUT Claude Code: `npx oh-my-hi`, or a global

5// install exposing `oh-my-hi` / `omh`. It's a thin launcher that delegates to

6// the dashboard generator, which builds output/ and (in full mode) starts the

7// local server and opens a browser. All flags (--data-only, --help, --update,

8// <path>…) pass straight through.

9//

10// Data selection is by config-dir discovery (CLAUDE_CONFIG_DIR / CODEX_HOME),

11// independent of how this launcher was invoked.

12import { spawn } from 'child_process';

13import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/oh-my-hi.mjsView on unpkg · L11

14import path from 'path';

16const __dirname = path.dirname(fileURLToPath(import.meta.url));

17const script = path.join(__dirname, '..', 'scripts', 'generate-dashboard.mjs');

19const child = spawn(process.execPath, [script, ...process.argv.slice(2)], {

20 stdio: 'inherit',

21});

23child.on('exit', (code, signal) => {

24 if (signal) process.kill(process.pid, signal);

25 else process.exit(code ?? 0);

26});

27child.on('error', (err) => {

28 console.error('oh-my-hi:', err.message);

29 process.exit(1);

30});

scripts/serve.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// @ts-check

3// serve.mjs — local HTTP server for oh-my-hi dashboard.

4//

5// Serves output/ as static files and exposes two API endpoints backed by

6// the SQLite snapshot written by generate-dashboard.mjs:

7// GET /api/meta — data.json with usage arrays stripped + segment index

8// GET /api/usage?... — queried usage payload from SQLite

9// GET /api/usage?format=csv|json&from=&to=&scope=

10// — token-usage export download (see handleUsageExport)

11// GET /api/search?q=... — FTS5 full-text search over user prompts

13import http from 'http';

14import fs from 'fs';

15import path from 'path';

16import { execSync, spawnSync } from 'child_process';

17import { fileURLToPath } from 'url';

18import {

19 buildExportRows, toCsv, parseDateParam, exportFilename, PRICING_FALLBACK,

20} from './export.mjs';

22const __filename = fileURLToPath(import.meta.url);

23const __dirname = path.dirname(__filename);

24const ROOT = path.resolve(__dirname, '..');

25// OMH_OUTPUT_DIR override matches generate-dashboard.mjs (also used by tests).

26const OUTPUT_DIR = process.env.OMH_OUTPUT_DIR || path.join(ROOT, 'output');

27const LEGACY_DB_PATH = path.join(OUTPUT_DIR, 'oh-my-hi.sqlite');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/serve.mjsView on unpkg · L12

28const DATA_JSON = path.join(OUTPUT_DIR, 'data.json');

29const CACHE_DIR = path.join(OUTPUT_DIR, 'cache');

30const LOCK_FILE = path.join(CACHE_DIR, '.serve.json');

32// Load the db module lazily — static file serving works even without SQLite.

Lines 393-433javascript

393 if found then exit repeat

394 end repeat

395 end if

396 if not found then

397 activate

398 open location theURL

399 end if

400end tell`;

401

402 const r = spawnSync('osascript', [], { input: script, encoding: 'utf8', timeout: 5000 });

403 return r.status === 0;

404}

scripts/generate-dashboard.mjsView file

Lines 3-50javascript

3// generate-dashboard.mjs — oh-my-hi dashboard generator

5/**

6 * @typedef {{ id: string, label: string, type: 'global'|'project',

7 * configPath: string, projectPath: string|null }} Scope

8 */

10/**

11 * @typedef {{ globalClaudeTokens: number, projectClaudeTokens: number,

12 * autoMemoryTokens: number, skillsDescTokens: number,

13 * mcpToolsTokens: number, principlesTokens: number }} ContextStats

14 */

16/**

17 * @typedef {{ usage: import('./parsers/usage.mjs').UsageResult,

18 * contextStats: ContextStats,

19 * dateRange: { start: number|null, end: number|null } }} ScopeData

20 */

21import { fileURLToPath } from 'url';

22import path from 'path';

23import fs from 'fs';

24import { execSync, spawnSync, spawn } from 'child_process';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/generate-dashboard.mjsView on unpkg · L23

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/generate-dashboard.mjsView on unpkg · L23

26// Auto-install dependencies if missing

27const __boot_dir = path.dirname(fileURLToPath(import.meta.url));

28const __boot_root = path.resolve(__boot_dir, '..');

29if (!fs.existsSync(path.join(__boot_root, 'node_modules'))) {

30 console.log('oh-my-hi: installing dependencies...');

31 execSync('npm install --omit=dev', { cwd: __boot_root, stdio: 'inherit' });

32}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/generate-dashboard.mjsView on unpkg · L30

34const { transformSync } = await import('esbuild');

36import { parseSkills } from './parsers/skills.mjs';

37import { parseAgents } from './parsers/agents.mjs';

38import { parsePlugins } from './parsers/plugins.mjs';

39import { parseHooks } from './parsers/hooks.mjs';

40import { parseMemory } from './parsers/memory.mjs';

41import { parseMcpServers } from './parsers/mcp-servers.mjs';

42import { parseRules, parsePrinciples } from './parsers/rules.mjs';

43import { parseCommands } from './parsers/commands.mjs';

44import { parseTeams } from './parsers/teams.mjs';

45import { parsePlans } from './parsers/plans.mjs';

46import { parseTodos } from './parsers/todos.mjs';

47import { parseConfigFiles } from './parsers/config-files.mjs';

48import { lintScope } from './parsers/lint.mjs';

49import { parseUsage, loadMtimeIndex, saveMtimeIndex, scanTranscriptMonths } from './parsers/usage.mjs';

50import { detectScopes } from './parsers/scopes.mjs';