@2digits/opencode-plugin@0.2.47
OpenCode plugin for PostHog LLM analytics integration
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe prompt and tool data collection matches the plugin's stated analytics purpose, but the default configuration also associates that data with the user's Git email and sends it using a bundled key. This identifying runtime telemetry warrants a warning.
Decision evidence
public snapshot- The package describes itself as an OpenCode plugin for PostHog LLM analytics.
- The plugin defaults to a bundled PostHog API key and the eu.i.posthog.com host; privacy mode is off unless enabled by an environment variable.
- It reads the Git email and uses it as the PostHog distinct ID unless a distinct ID is configured.
- Generation events include the user prompt and assistant output when privacy mode is off.
- Sending OpenCode prompts, outputs, and tool spans to PostHog is the plugin's stated analytics purpose.
- The host and API key can be overridden through environment variables, and privacy mode can be enabled.
Source & flagged code
5 flaggedThe package describes itself as an OpenCode plugin for PostHog LLM analytics.
package.jsonView on unpkg · L4The plugin defaults to a bundled PostHog API key and the eu.i.posthog.com host; privacy mode is off unless enabled by an environment variable.
dist/index.mjsView on unpkg · L2Findings
Affected versions and remediation
This report applies to @2digits/opencode-plugin@0.2.47.
See all versions of @2digits/opencode-plugin for other recorded verdicts.
- Review the evidence and your use of @2digits/opencode-plugin@0.2.47 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.