registry / AI-agent capability abuse / openchamber-sogawugu / 1.21.6

openchamber-sogawugu@1.21.6

[![GitHub stars](https://img.shields.io/github/stars/openchamber/openchamber?style=flat&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0iI2YxZWNlYyIgdmlld0JveD0iMCAwIDI1Ni

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No evidence supports a malicious npm install chain or data theft. The package nevertheless provides explicit-user-command mutation of external AI-agent skill surfaces and persistence, so it should be warned rather than marked clean.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the CLI startup enable command or uses the application's skill-management feature.

Impact

A user or an authenticated application client can persist the service or change agent instructions in configured user or project skill directories.

Mechanism

User-directed AI-agent skill management and startup-service installation.

AI rationale

Evidence

bin/lib/commands-startup.jsbin/lib/cli-startup.jsserver/lib/opencode/skills.jsserver/lib/agent-tool/runtime.js~/.claude/skills/<skillName>/SKILL.md~/.agents/skills/<skillName>/SKILL.md.opencode/skills/<skillName>/SKILL.md

Network endpoints1

127.0.0.1:${port}/api/openchamber/agent-tool

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The running application can create and modify skill files for OpenCode, Claude, and Agents locations.
An explicit startup enable command installs a persistent user service.
The package launches and manages an OpenCode coding-agent service.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The startup service is reached only through the explicit startup enable subcommand.
The managed agent plugin is written to the package data directory and points to a loopback endpoint.
No source evidence shows secret exfiltration, remote payload execution, or automatic install-time mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinified

Source & flagged code

12 flagged

bin/cli.test.jsView file

6import net from 'net'; L7: import { spawn } from 'child_process'; L8: import { pathToFileURL } from 'url';

High

Child Process

Package source references child process execution.

bin/cli.test.jsView on unpkg · L6

bin/lib/cli-startup.jsView file

52L53: function powershellQuote(value) { L54: return `'${String(value).replace(/'/g, "''")}'`;

High

Shell

Package source references shell execution.

bin/lib/cli-startup.jsView on unpkg · L52

3Trigger-reachable persistence chain: scripts.start -> bin/cli.js -> bin/lib/commands-startup.js -> bin/lib/cli-startup.js L3: import path from 'path'; L4: import { spawnSync } from 'child_process'; L5: import { DEFAULT_PORT } from './cli-args.js'; ... L13: function getStartupServicePaths() { L14: if (process.platform === 'darwin') { L15: return { L16: platform: 'macos', L17: servicePath: path.join(os.homedir(), 'Library', 'LaunchAgents', `${STARTUP_SERVICE_ID}.plist`), L18: }; ... L78: const env = options.envSnapshot === false ? {} : Object.fromEntries( L79: Object.entries(process.env) L80: .filter(([key, value]) => shouldPersistStartupEnv(key, value))

Findings

8 High5 Medium8 Low

HighChild Processbin/cli.test.js

HighShellbin/lib/cli-startup.js

HighEntrypoint Build Divergenceserver/index.js

HighSame File Env Network Executionserver/lib/opencode/lifecycle.js

HighSandbox Evasion Gated Capabilityserver/lib/cloudflare-tunnel.js

HighTrigger Reachable External Ai Agent Control Surface Mutationserver/lib/opencode/skills.js

HighTrigger Reachable Persistencebin/lib/cli-startup.js

HighSemantic Analysis Limiteddist/assets/useAppFontEffects-BQRdlJ2h.js

MediumDynamic Requirebin/lib/commands-serve.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/lib/cli-startup.js

Affected versions and remediation

This report applies to openchamber-sogawugu@1.21.6.

See all versions of openchamber-sogawugu for other recorded verdicts.

Review the evidence and your use of openchamber-sogawugu@1.21.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-08 09:53:56.264Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / AI-agent capability abuse / openchamber-sogawugu / 1.21.6

openchamber-sogawugu@1.21.6

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the CLI startup enable command or uses the application's skill-management feature.

Impact

A user or an authenticated application client can persist the service or change agent instructions in configured user or project skill directories.

Mechanism

User-directed AI-agent skill management and startup-service installation.

AI rationale

Evidence

Network endpoints1

127.0.0.1:${port}/api/openchamber/agent-tool

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The running application can create and modify skill files for OpenCode, Claude, and Agents locations.
An explicit startup enable command installs a persistent user service.
The package launches and manages an OpenCode coding-agent service.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The startup service is reached only through the explicit startup enable subcommand.
The managed agent plugin is written to the package data directory and points to a loopback endpoint.
No source evidence shows secret exfiltration, remote payload execution, or automatic install-time mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinified

Source & flagged code

12 flagged

bin/cli.test.jsView file

6import net from 'net'; L7: import { spawn } from 'child_process'; L8: import { pathToFileURL } from 'url';

High

Child Process

Package source references child process execution.

bin/cli.test.jsView on unpkg · L6

bin/lib/cli-startup.jsView file

52L53: function powershellQuote(value) { L54: return `'${String(value).replace(/'/g, "''")}'`;

High

Shell

Package source references shell execution.

bin/lib/cli-startup.jsView on unpkg · L52

Findings

8 High5 Medium8 Low

HighChild Processbin/cli.test.js

HighShellbin/lib/cli-startup.js

HighEntrypoint Build Divergenceserver/index.js

HighSame File Env Network Executionserver/lib/opencode/lifecycle.js

HighSandbox Evasion Gated Capabilityserver/lib/cloudflare-tunnel.js

HighTrigger Reachable External Ai Agent Control Surface Mutationserver/lib/opencode/skills.js

HighTrigger Reachable Persistencebin/lib/cli-startup.js

HighSemantic Analysis Limiteddist/assets/useAppFontEffects-BQRdlJ2h.js

MediumDynamic Requirebin/lib/commands-serve.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/lib/cli-startup.js

Affected versions and remediation

This report applies to openchamber-sogawugu@1.21.6.

See all versions of openchamber-sogawugu for other recorded verdicts.

Review the evidence and your use of openchamber-sogawugu@1.21.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-08 09:53:56.264Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.