osborn@0.9.247
Voice AI coding assistant - local agent that connects to Osborn frontend
AI Security Review
scanned 23d ago · by lpm-firewall-aiThe inspected source establishes persistent global agent configuration changes through CLI use, which warrants a behavior-specific warning under the supplied policy. It does not establish malicious installation behavior or credential theft.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Launching osborn; sending a skill_add command through the frontend.
Impact
Changes affect Claude sessions beyond Osborn, extending retention and making added instructions available globally.
Mechanism
Module initialization rewrites Claude settings, and the skill handler saves supplied content under the user's global Claude skills directory.
AI rationale
The inspected source establishes persistent global agent configuration changes through CLI use, which warrants a behavior-specific warning under the supplied policy. It does not establish malicious installation behavior or credential theft.
Evidence
bin/cli.jsdist/index.jsdist/claude-llm.jssettings.jsonSKILL.md
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json has no npm installation lifecycle hooks.
- bin/cli.js launches dist/index.js, which imports dist/claude-llm.js.
- Importing dist/claude-llm.js changes global Claude settings without a separate consent check.
- The settings changes increase the compaction window and retain sessions for 3650 days.
- A frontend skill_add command writes supplied instructions into global Claude skills.
Evidence against
- The behavior activates through the CLI rather than npm installation.
- Skill names are sanitized, and the skill write requires a specific frontend command.
- Inspected authentication fallback uses an OpenRouter key for OpenRouter rather than forwarding existing Claude credentials.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcebin/recall.jsView file
5L6: import { spawn } from 'child_process'
L7: import { fileURLToPath } from 'url'
High
dist/jsonl-search.jsView file
34// @vscode/ripgrep bundles the rg binary — this is our own dependency
L35: const { rgPath } = require('@vscode/ripgrep');
L36: if (rgPath && existsSync(rgPath))
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/jsonl-search.jsView on unpkg · L34dist/index.jsView file
2575const which = await new Promise((res) => {
L2576: const p = spawn('which', ['code-server']);
L2577: let out = '';
...
L2584: await new Promise((res, rej) => {
L2585: const install = spawn('sh', ['-c', 'curl -fsSL https://code-server.dev/install.sh | sh'], {
L2586: env: { ...process.env },
L2587: stdio: ['ignore', 'pipe', 'pipe'],
Findings
4 Critical3 High5 Medium5 Low
CriticalSame File Env Network Executiondist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDownload Executedist/index.js
HighChild Processbin/recall.js
HighShell
HighSemantic Analysis Limiteddist/session-access.js#virtual:normalized:round1
MediumDynamic Requiredist/jsonl-search.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdeploy.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to osborn@0.9.247.
See all versions of osborn for other recorded verdicts.
- Review the evidence and your use of osborn@0.9.247 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.