registry / openchamber-sogawugu / 1.21.8

openchamber-sogawugu@1.21.8

⚠ Under review

[![GitHub stars](https://img.shields.io/github/stars/openchamber/openchamber?style=flat&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0iI2YxZWNlYyIgdmlld0JveD0iMCAwIDI1Ni

AI Security Review

scanned 19d ago · by lpm-firewall-ai

The inspected findings are consistent with user-triggered product behavior, and the manifest shows no install lifecycle hook. The supplied clean citation coverage requires 132 distinct references, exceeding the 128-reference limit, so the result is manual review as instructed.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user saves global behavior text in Settings or runs the startup enable command.

Impact

No malicious impact was established from these user-triggered behaviors.

Mechanism

The server stores supplied text in the OpenCode AGENTS.md file; the CLI can configure a startup service when explicitly enabled.

AI rationale

Evidence

server/lib/opencode/routes.jsdist/assets/SettingsView-Ch8CtEXA.jsbin/lib/commands-startup.jsbin/lib/cli-startup.js

Decision evidence

public snapshot

AI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json lists development, build, lint, and test scripts; no install lifecycle hook is shown.
The server exposes a global OpenCode AGENTS.md endpoint and writes the content supplied to it.
The Settings UI sends that content through a save action, and its Save Changes button invokes the action.
Startup persistence is enabled through an explicit startup command.
The CLI authentication helper requests a session from the local server and retries its request to that same local URL.

Evidence against

The inspected configuration write is reached through a Settings save action, not an install hook.
The inspected persistence behavior requires the explicit startup enable command.
The inspected CLI session flow targets the local server; no unrelated credential recipient was found in that flow.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Source & flagged code

12 flagged

bin/cli.test.jsView file

6import net from 'net'; L7: import { spawn } from 'child_process'; L8: import { pathToFileURL } from 'url';

High

Child Process

Package source references child process execution.

bin/cli.test.jsView on unpkg · L6

bin/lib/cli-startup.jsView file

52L53: function powershellQuote(value) { L54: return `'${String(value).replace(/'/g, "''")}'`;

High

Shell

Package source references shell execution.

bin/lib/cli-startup.jsView on unpkg · L52

3Trigger-reachable persistence chain: scripts.start -> bin/cli.js -> bin/lib/commands-startup.js -> bin/lib/cli-startup.js L3: import path from 'path'; L4: import { spawnSync } from 'child_process'; L5: import { DEFAULT_PORT } from './cli-args.js'; ... L13: function getStartupServicePaths() { L14: if (process.platform === 'darwin') { L15: return { L16: platform: 'macos', L17: servicePath: path.join(os.homedir(), 'Library', 'LaunchAgents', `${STARTUP_SERVICE_ID}.plist`), L18: }; ... L78: const env = options.envSnapshot === false ? {} : Object.fromEntries( L79: Object.entries(process.env) L80: .filter(([key, value]) => shouldPersistStartupEnv(key, value))

Findings

9 High5 Medium7 Low

HighChild Processbin/cli.test.js

HighShellbin/lib/cli-startup.js

HighEntrypoint Build Divergenceserver/index.js

HighSame File Env Network Executionserver/lib/opencode/lifecycle.js

HighSandbox Evasion Gated Capabilityserver/lib/cloudflare-tunnel.js

HighTrigger Reachable External Ai Agent Control Surface Mutationserver/lib/opencode/skills.js

HighTrigger Reachable Persistencebin/lib/cli-startup.js

HighSemantic Analysis Limiteddist/assets/useAppFontEffects-DciDHxCs.js

HighPrevious Version Dangerous Deltaserver/lib/git/service.js

MediumDynamic Requirebin/lib/commands-serve.js

MediumNetwork

Medium

Affected versions and remediation

This report applies to openchamber-sogawugu@1.21.8.

See all versions of openchamber-sogawugu for other recorded verdicts.

Review the evidence and your use of openchamber-sogawugu@1.21.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 00:48:21.678Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / openchamber-sogawugu / 1.21.8

openchamber-sogawugu@1.21.8

⚠ Under review

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user saves global behavior text in Settings or runs the startup enable command.

Impact

No malicious impact was established from these user-triggered behaviors.

Mechanism

The server stores supplied text in the OpenCode AGENTS.md file; the CLI can configure a startup service when explicitly enabled.

AI rationale

Evidence

server/lib/opencode/routes.jsdist/assets/SettingsView-Ch8CtEXA.jsbin/lib/commands-startup.jsbin/lib/cli-startup.js

Decision evidence

public snapshot

AI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json lists development, build, lint, and test scripts; no install lifecycle hook is shown.
The server exposes a global OpenCode AGENTS.md endpoint and writes the content supplied to it.
The Settings UI sends that content through a save action, and its Save Changes button invokes the action.
Startup persistence is enabled through an explicit startup command.
The CLI authentication helper requests a session from the local server and retries its request to that same local URL.

Evidence against

The inspected configuration write is reached through a Settings save action, not an install hook.
The inspected persistence behavior requires the explicit startup enable command.
The inspected CLI session flow targets the local server; no unrelated credential recipient was found in that flow.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Source & flagged code

12 flagged

bin/cli.test.jsView file

6import net from 'net'; L7: import { spawn } from 'child_process'; L8: import { pathToFileURL } from 'url';

High

Child Process

Package source references child process execution.

bin/cli.test.jsView on unpkg · L6

bin/lib/cli-startup.jsView file

52L53: function powershellQuote(value) { L54: return `'${String(value).replace(/'/g, "''")}'`;

High

Shell

Package source references shell execution.

bin/lib/cli-startup.jsView on unpkg · L52

Findings

9 High5 Medium7 Low

HighChild Processbin/cli.test.js

HighShellbin/lib/cli-startup.js

HighEntrypoint Build Divergenceserver/index.js

HighSame File Env Network Executionserver/lib/opencode/lifecycle.js

HighSandbox Evasion Gated Capabilityserver/lib/cloudflare-tunnel.js

HighTrigger Reachable External Ai Agent Control Surface Mutationserver/lib/opencode/skills.js

HighTrigger Reachable Persistencebin/lib/cli-startup.js

HighSemantic Analysis Limiteddist/assets/useAppFontEffects-DciDHxCs.js

HighPrevious Version Dangerous Deltaserver/lib/git/service.js

MediumDynamic Requirebin/lib/commands-serve.js

MediumNetwork

Medium

Affected versions and remediation

This report applies to openchamber-sogawugu@1.21.8.

See all versions of openchamber-sogawugu for other recorded verdicts.

Review the evidence and your use of openchamber-sogawugu@1.21.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 00:48:21.678Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.