osborn@0.9.149
Voice AI coding assistant - local agent that connects to Osborn frontend
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe inspected source ties the flagged operations to CLI startup, Claude session handling, and room-based voice functionality. The runtime account-action locations resolve to file-edit review and session start or recovery; no concrete attack surface was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI or starts or resumes a voice session.
Impact
No unauthorized credential transfer, account action, or agent control-surface change was established.
Mechanism
The package launches its agent, handles session and prompt context, and mints a room-scoped token for LiveKit.
AI rationale
The inspected source ties the flagged operations to CLI startup, Claude session handling, and room-based voice functionality. The runtime account-action locations resolve to file-edit review and session start or recovery; no concrete attack surface was found.
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json exposes the osborn CLI and has a prepublishOnly build hook, with no preinstall, install, or postinstall hook.
- The Claude auth and session code reads Claude credentials to check authentication and persists a token obtained through its interactive OAuth flow; the inspected source did not show sending saved credentials to another endpoint.
- Claude integration locations read skill and project-session data from Claude directories; the inspected excerpts show local paths and session indexing.
- The CLI launches the package entrypoint with the current environment. Runtime excerpts show session creation, recovery, voice-session setup, and room-scoped LiveKit token minting.
- Runtime operation excerpts handle session context, voice queues, research updates, and MCP tool state; the account-action candidate is file-edit diff construction, while its callers start or recover voice sessions.
- The MCP proxy and fast-brain excerpts support tool proxying and prompt/context construction; no concrete unauthorized account action, credential transfer, or control-surface abuse was identified.
Evidence against
Behavioral surface
Source & flagged code
7 flagged · loading sourcebin/cli.jsView file
2L3: import { spawn } from 'child_process'
L4: import { fileURLToPath } from 'url'
High
dist/jsonl-search.jsView file
34// @vscode/ripgrep bundles the rg binary — this is our own dependency
L35: const { rgPath } = require('@vscode/ripgrep');
L36: if (rgPath && existsSync(rgPath))
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/jsonl-search.jsView on unpkg · L34dist/index.jsView file
11setMaxListeners(50);
L12: import { createServer } from 'http';
L13: import { existsSync, readdirSync, readFileSync, mkdirSync, writeFileSync, mkdtempSync, cpSync, rmSync, statSync, utimesSync, createWriteStream } from 'node:fs';
...
L15: import { fileURLToPath } from 'node:url';
L16: import { spawn } from 'node:child_process';
L17: import { randomUUID } from 'node:crypto';
L18: import { createRequire } from 'node:module';
L19: // 0.9.71: createRequire for resolving package.json versions inside ESM
L20: const __sdkVersionRequire = createRequire(import.meta.url);
...
L22: import { PassThrough } from 'node:stream';
L23: import { createGunzip } from 'node:zlib';
L24: // Resolve __dirname for this ESM module so we can find sibling files (e.g.
Findings
2 Critical4 High5 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processbin/cli.js
HighShell
HighCommand Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/session-access.js#virtual:normalized:round1
MediumDynamic Requiredist/jsonl-search.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdeploy.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to osborn@0.9.149.
See all versions of osborn for other recorded verdicts.
- Review the evidence and your use of osborn@0.9.149 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.