Is oathe-ai/oathfish safe?
https://github.com/oathe-ai/oathfish
OathFish is a sophisticated Claude Code plugin implementing a swarm-intelligence prediction engine that spawns 30 archetype subagents for multi-round deliberation followed by mass amplification via 1500+ claude -p invocations. The skill is architecturally complex, well-documented, and appears to be a legitimate research tool rather than a malicious one; no canary files were accessed by the skill, no data exfiltration commands are present in SKILL.md, and clone behavior was normal. However, the skill's extensive use of live shell execution at load time, an auto-starting Python MCP server, lifecycle hooks, and broad tool permissions (including unrestricted Agent spawning and WebSearch) create significant attack surface and compute amplification potential that warrants careful review before installation in sensitive environments.
Category Scores
Findings (11)
HIGH Live shell execution at skill load time -20 ▶
Every SKILL.md file in the oathfish plugin uses the ! backtick live-execution syntax to run shell commands the moment the skill is invoked. Commands include get-state.sh, direct cat/jq pipelines on PLUGIN_DATA files, and conditional shell expressions. These execute before any user prompt is processed and before the agent can reason about safety.
HIGH Python MCP server auto-starts as local subprocess -15 ▶
The plugin bundles a full Python MCP server (engine/server.py + 13 modules) configured to auto-start via .mcp.json at every Claude Code session startup when the plugin is enabled. The server runs with stdio transport, has direct filesystem access, and manages persistent state across sessions. The user has no explicit approval step for this process.
MEDIUM Unrestricted Agent tool permission enables unlimited subagent spawning -12 ▶
The main oathfish dispatcher skill requests allowed-tools including Agent with no type restriction. The deliberate phase is explicitly designed to spawn 30 typed archetype subagents in the main thread. This gives the skill control over the agent orchestration graph, potentially enabling subagent sprawl that consumes significant compute and context resources without user awareness.
MEDIUM Lifecycle hooks execute shell commands without per-event user approval -12 ▶
hooks/hooks.json configures multiple Claude Code lifecycle hooks including SessionStart (runs oathfish-init.sh), SessionStart compact (runs oathfish-reinject-state.sh), PreToolUse on SendMessage (runs validate-no-numbers.sh), TeammateIdle, TaskCompleted, and Stop hooks. These shell scripts execute automatically at lifecycle events without explicit user approval for each invocation.
MEDIUM Mass amplification via claude -p creates high-volume outbound API traffic -12 ▶
The amplify and baseline-amplify skills run up to 1500+ independent claude -p invocations per run (50 variations × 30 archetypes). Each call makes an outbound API request with injected --system-prompt content derived from archetype definitions. This high-volume outbound traffic is difficult to audit and the system-prompt contents could encode data from the agent's context window.
MEDIUM Synthetic consensus generation risk for influence operations -20 ▶
The skill's core mechanism — simulating 30 population archetypes deliberating over a topic and producing statistical distributions — can generate realistic-appearing synthetic poll data and 'population reactions' to any topic. While designed for legitimate research, this infrastructure could be used to fabricate public opinion data, manufacture apparent consensus, or generate influence operation content at scale.
MEDIUM WebSearch with external content ingestion into deliberation pipeline -12 ▶
The understand phase performs WebSearch for 3-5 real public sources per archetype (up to 150 web fetches per run) and injects retrieved content as grounding into archetype system prompts. External web content becomes part of the deliberation pipeline without sanitization. A topic crafted to surface attacker-controlled content could poison the archetype grounding.
LOW Pre-compiled Python bytecode shipped in repository -8 ▶
The repository contains pre-compiled Python .pyc bytecode files in engine/pycache/ for all engine modules. These bytecode files were committed to git and are executed directly by the Python interpreter, bypassing source-level code review. Bytecode could differ from the shipped .py source files.
LOW Multiple clone attempts detected in monitoring -10 ▶
The audit monitoring detected two distinct git clone invocations for the same repository URL. The second clone failed because the destination existed. This is consistent with the audit framework's retry logic rather than the skill self-replicating, but indicates the clone was run at least twice.
INFO Canary file accesses attributable to audit system sudo process -5 ▶
Syscall records show accesses to honeypot files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json) at timestamp 1787685214, pre-dating the git clone at 1787685219. These accesses are from pid=1107 (sudo) with ppid=1085 during audit infrastructure initialization, not from the skill.
INFO Clone network traffic limited to GitHub HTTPS 0 ▶
All network connections during the git clone phase were to 140.82.121.4:443 (GitHub) over HTTPS. DNS resolved github.com to this address. No unexpected external endpoints, no covert channels, no connections to non-GitHub infrastructure during clone.