osborn@0.9.245
Voice AI coding assistant - local agent that connects to Osborn frontend
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe package is not malicious by the inspected evidence, but it exposes persisted Claude configuration and skill-writing capability through its agent frontend. This warrants a non-blocking warning because authorization for that control path is not established in the inspected source.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A frontend skill_add message, or loading the Claude LLM module.
Impact
A party able to send the frontend message can influence future Claude-agent behavior through persisted skill content.
Mechanism
The agent creates a skill directory and writes supplied content to a Claude skill file; the LLM integration modifies Claude settings.
AI rationale
The package is not malicious by the inspected evidence, but it exposes persisted Claude configuration and skill-writing capability through its agent frontend. This warrants a non-blocking warning because authorization for that control path is not established in the inspected source.
Evidence
dist/index.jsdist/claude-llm.js~/.claude/skills/<skillName>/SKILL.md~/.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package has command entrypoints and no install lifecycle hook in its declared scripts.
- A frontend message named skill_add accepts supplied content and writes it as a Claude skill under the user's home directory.
- On module load, the Claude integration changes settings in the user's Claude configuration.
- The OAuth token handling persists a token locally for the Claude SDK rather than sending it to a separate endpoint.
Evidence against
- No package install, preinstall, or postinstall hook was found.
- No source evidence established secret exfiltration or a hidden remote command-and-control endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcebin/recall.jsView file
5L6: import { spawn } from 'child_process'
L7: import { fileURLToPath } from 'url'
High
dist/jsonl-search.jsView file
34// @vscode/ripgrep bundles the rg binary — this is our own dependency
L35: const { rgPath } = require('@vscode/ripgrep');
L36: if (rgPath && existsSync(rgPath))
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/jsonl-search.jsView on unpkg · L34dist/index.jsView file
2575const which = await new Promise((res) => {
L2576: const p = spawn('which', ['code-server']);
L2577: let out = '';
...
L2584: await new Promise((res, rej) => {
L2585: const install = spawn('sh', ['-c', 'curl -fsSL https://code-server.dev/install.sh | sh'], {
L2586: env: { ...process.env },
L2587: stdio: ['ignore', 'pipe', 'pipe'],
Findings
4 Critical3 High5 Medium5 Low
CriticalSame File Env Network Executiondist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDownload Executedist/index.js
HighChild Processbin/recall.js
HighShell
HighSemantic Analysis Limiteddist/session-access.js#virtual:normalized:round1
MediumDynamic Requiredist/jsonl-search.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdeploy.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to osborn@0.9.245.
See all versions of osborn for other recorded verdicts.
- Review the evidence and your use of osborn@0.9.245 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.