registry / AI-agent capability abuse / openchamber-sogawugu / 1.21.5

openchamber-sogawugu@1.21.5

[![GitHub stars](https://img.shields.io/github/stars/openchamber/openchamber?style=flat&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0iI2YxZWNlYyIgdmlld0JveD0iMCAwIDI1Ni

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has meaningful runtime control-surface and persistence capabilities, so it warrants a warning. It lacks npm install hooks and the inspected risky actions are not automatically triggered by installation.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs the application, calls its configuration API, or enables startup integration.

Impact

A user or a party able to access the running server could add behavior-bearing skill files or enable persistence.

Mechanism

Runtime AI-agent configuration mutation and optional user-service registration.

AI rationale

Evidence

server/lib/opencode/skill-routes.jsserver/lib/opencode/skills.jsbin/lib/cli-startup.jsserver/lib/cloudflare-tunnel.js.opencode/skills.agents/skills~/Library/LaunchAgents/dev.openchamber.web.plist~/.config/systemd/user/openchamber.service

Network endpoints1

api.trycloudflare.com

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The runtime API creates user- or project-scoped AI-agent skill files.
The CLI can install a per-user startup service on macOS and Linux.
The server can probe the Cloudflare tunnel API at runtime.

Evidence against

package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
The persistence and skill writes require running the application or using its API; they are not install-time actions.
The child-process use in bin/cli.test.js is test code.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

Source & flagged code

13 flagged

bin/cli.test.jsView file

6import net from 'net'; L7: import { spawn } from 'child_process'; L8: import { pathToFileURL } from 'url';

High

Child Process

Package source references child process execution.

bin/cli.test.jsView on unpkg · L6

bin/lib/cli-startup.jsView file

52L53: function powershellQuote(value) { L54: return `'${String(value).replace(/'/g, "''")}'`;

High

Shell

Package source references shell execution.

bin/lib/cli-startup.jsView on unpkg · L52

3Trigger-reachable persistence chain: scripts.start -> bin/cli.js -> bin/lib/commands-startup.js -> bin/lib/cli-startup.js L3: import path from 'path'; L4: import { spawnSync } from 'child_process'; L5: import { DEFAULT_PORT } from './cli-args.js'; ... L13: function getStartupServicePaths() { L14: if (process.platform === 'darwin') { L15: return { L16: platform: 'macos', L17: servicePath: path.join(os.homedir(), 'Library', 'LaunchAgents', `${STARTUP_SERVICE_ID}.plist`), L18: }; ... L78: const env = options.envSnapshot === false ? {} : Object.fromEntries( L79: Object.entries(process.env) L80: .filter(([key, value]) => shouldPersistStartupEnv(key, value))

Findings

9 High5 Medium8 Low

HighChild Processbin/cli.test.js

HighShellbin/lib/cli-startup.js

HighEntrypoint Build Divergenceserver/index.js

HighSame File Env Network Executionserver/lib/opencode/lifecycle.js

HighSandbox Evasion Gated Capabilityserver/lib/cloudflare-tunnel.js

HighTrigger Reachable External Ai Agent Control Surface Mutationserver/lib/opencode/skills.js

HighTrigger Reachable Persistencebin/lib/cli-startup.js

HighSemantic Analysis Limiteddist/assets/useAppFontEffects-2bAH4uhn.js

HighPrevious Version Dangerous Deltaserver/index.js

MediumDynamic Requirebin/lib/commands-serve.js

MediumNetwork

Medium

Affected versions and remediation

This report applies to openchamber-sogawugu@1.21.5.

See all versions of openchamber-sogawugu for other recorded verdicts.

Review the evidence and your use of openchamber-sogawugu@1.21.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-06 04:12:33.811Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / AI-agent capability abuse / openchamber-sogawugu / 1.21.5

openchamber-sogawugu@1.21.5

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs the application, calls its configuration API, or enables startup integration.

Impact

A user or a party able to access the running server could add behavior-bearing skill files or enable persistence.

Mechanism

Runtime AI-agent configuration mutation and optional user-service registration.

AI rationale

Evidence

Network endpoints1

api.trycloudflare.com

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The runtime API creates user- or project-scoped AI-agent skill files.
The CLI can install a per-user startup service on macOS and Linux.
The server can probe the Cloudflare tunnel API at runtime.

Evidence against

package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
The persistence and skill writes require running the application or using its API; they are not install-time actions.
The child-process use in bin/cli.test.js is test code.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

Source & flagged code

13 flagged

bin/cli.test.jsView file

6import net from 'net'; L7: import { spawn } from 'child_process'; L8: import { pathToFileURL } from 'url';

High

Child Process

Package source references child process execution.

bin/cli.test.jsView on unpkg · L6

bin/lib/cli-startup.jsView file

52L53: function powershellQuote(value) { L54: return `'${String(value).replace(/'/g, "''")}'`;

High

Shell

Package source references shell execution.

bin/lib/cli-startup.jsView on unpkg · L52

Findings

9 High5 Medium8 Low

HighChild Processbin/cli.test.js

HighShellbin/lib/cli-startup.js

HighEntrypoint Build Divergenceserver/index.js

HighSame File Env Network Executionserver/lib/opencode/lifecycle.js

HighSandbox Evasion Gated Capabilityserver/lib/cloudflare-tunnel.js

HighTrigger Reachable External Ai Agent Control Surface Mutationserver/lib/opencode/skills.js

HighTrigger Reachable Persistencebin/lib/cli-startup.js

HighSemantic Analysis Limiteddist/assets/useAppFontEffects-2bAH4uhn.js

HighPrevious Version Dangerous Deltaserver/index.js

MediumDynamic Requirebin/lib/commands-serve.js

MediumNetwork

Medium

Affected versions and remediation

This report applies to openchamber-sogawugu@1.21.5.

See all versions of openchamber-sogawugu for other recorded verdicts.

Review the evidence and your use of openchamber-sogawugu@1.21.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-06 04:12:33.811Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.