registry / AI-agent capability abuse / openchamber-sogawugu / 1.21.2

openchamber-sogawugu@1.21.2

[![GitHub stars](https://img.shields.io/github/stars/openchamber/openchamber?style=flat&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0iI2YxZWNlYyIgdmlld0JveD0iMCAwIDI1Ni

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is not malicious from the inspected source, but it has real user-invoked persistence and agent-control capabilities that warrant a warning. The absence of install hooks and self-dependency prevents the automatic supply-chain abuse classification.

Static reason

One or more suspicious static signals were detected.

Trigger

Running `openchamber startup enable` or using the application's skill-management actions.

Impact

A user-directed action can persist the OpenChamber server or alter skill instructions consumed by supported agent tools.

Mechanism

User-initiated service registration and AI-agent skill file management.

AI rationale

Evidence

bin/lib/cli-startup.jsserver/lib/opencode/skills.js~/Library/LaunchAgents/dev.openchamber.web.plist~/.config/systemd/user/openchamber.service~/.opencode/skills~/.agents/skills.opencode/skills.agents/skills

Network endpoints1

api.trycloudflare.com/

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package provides an explicit command that registers an OpenChamber service to run at user login.
The runtime can create and modify skill files in user and project AI-agent directories, including .agents and .opencode locations.
The server launches a configured OpenCode process and can invoke the local cloudflared executable.
The package has no npm install lifecycle hook or runtime dependency on its own package name.

Evidence against

The persistence function is reached through the explicit `openchamber startup enable` command, including in its tests.
The inspected network request is a bounded reachability check to Cloudflare's quick-tunnel service.
No credential collection, secret exfiltration, remote payload download, or install-time execution was found in the inspected sources.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork

Source & flagged code

12 flagged

bin/cli.test.jsView file

6import net from 'net'; L7: import { spawn } from 'child_process'; L8: import { pathToFileURL } from 'url';

High

Child Process

Package source references child process execution.

bin/cli.test.jsView on unpkg · L6

bin/lib/cli-startup.jsView file

52L53: function powershellQuote(value) { L54: return `'${String(value).replace(/'/g, "''")}'`;

High

Shell

Package source references shell execution.

bin/lib/cli-startup.jsView on unpkg · L52

3Trigger-reachable persistence chain: scripts.start -> bin/cli.js -> bin/lib/commands-startup.js -> bin/lib/cli-startup.js L3: import path from 'path'; L4: import { spawnSync } from 'child_process'; L5: import { DEFAULT_PORT } from './cli-args.js'; ... L13: function getStartupServicePaths() { L14: if (process.platform === 'darwin') { L15: return { L16: platform: 'macos', L17: servicePath: path.join(os.homedir(), 'Library', 'LaunchAgents', `${STARTUP_SERVICE_ID}.plist`), L18: }; ... L78: const env = options.envSnapshot === false ? {} : Object.fromEntries( L79: Object.entries(process.env) L80: .filter(([key, value]) => shouldPersistStartupEnv(key, value))

Findings

8 High5 Medium8 Low

HighChild Processbin/cli.test.js

HighShellbin/lib/cli-startup.js

HighEntrypoint Build Divergenceserver/index.js

HighSame File Env Network Executionserver/lib/opencode/lifecycle.js

HighSandbox Evasion Gated Capabilityserver/lib/cloudflare-tunnel.js

HighTrigger Reachable External Ai Agent Control Surface Mutationserver/lib/opencode/skills.js

HighTrigger Reachable Persistencebin/lib/cli-startup.js

HighSemantic Analysis Limiteddist/assets/useAppFontEffects-BTd2ge7n.js

MediumDynamic Requirebin/lib/commands-serve.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/lib/cli-startup.js

Affected versions and remediation

This report applies to openchamber-sogawugu@1.21.2.

See all versions of openchamber-sogawugu for other recorded verdicts.

Review the evidence and your use of openchamber-sogawugu@1.21.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-06 04:08:56.938Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / AI-agent capability abuse / openchamber-sogawugu / 1.21.2

openchamber-sogawugu@1.21.2

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

Running `openchamber startup enable` or using the application's skill-management actions.

Impact

A user-directed action can persist the OpenChamber server or alter skill instructions consumed by supported agent tools.

Mechanism

User-initiated service registration and AI-agent skill file management.

AI rationale

Evidence

Network endpoints1

api.trycloudflare.com/

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package provides an explicit command that registers an OpenChamber service to run at user login.
The runtime can create and modify skill files in user and project AI-agent directories, including .agents and .opencode locations.
The server launches a configured OpenCode process and can invoke the local cloudflared executable.
The package has no npm install lifecycle hook or runtime dependency on its own package name.

Evidence against

The persistence function is reached through the explicit `openchamber startup enable` command, including in its tests.
The inspected network request is a bounded reachability check to Cloudflare's quick-tunnel service.
No credential collection, secret exfiltration, remote payload download, or install-time execution was found in the inspected sources.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork

Source & flagged code

12 flagged

bin/cli.test.jsView file

6import net from 'net'; L7: import { spawn } from 'child_process'; L8: import { pathToFileURL } from 'url';

High

Child Process

Package source references child process execution.

bin/cli.test.jsView on unpkg · L6

bin/lib/cli-startup.jsView file

52L53: function powershellQuote(value) { L54: return `'${String(value).replace(/'/g, "''")}'`;

High

Shell

Package source references shell execution.

bin/lib/cli-startup.jsView on unpkg · L52

Findings

8 High5 Medium8 Low

HighChild Processbin/cli.test.js

HighShellbin/lib/cli-startup.js

HighEntrypoint Build Divergenceserver/index.js

HighSame File Env Network Executionserver/lib/opencode/lifecycle.js

HighSandbox Evasion Gated Capabilityserver/lib/cloudflare-tunnel.js

HighTrigger Reachable External Ai Agent Control Surface Mutationserver/lib/opencode/skills.js

HighTrigger Reachable Persistencebin/lib/cli-startup.js

HighSemantic Analysis Limiteddist/assets/useAppFontEffects-BTd2ge7n.js

MediumDynamic Requirebin/lib/commands-serve.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/lib/cli-startup.js

Affected versions and remediation

This report applies to openchamber-sogawugu@1.21.2.

See all versions of openchamber-sogawugu for other recorded verdicts.

Review the evidence and your use of openchamber-sogawugu@1.21.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-06 04:08:56.938Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.