@2digits/opencode-plugin@0.2.49
OpenCode plugin for PostHog LLM analytics integration
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe PostHog analytics purpose is disclosed, but the plugin automatically sends prompt and output content and a Git-derived identity using a built-in key. Because capture is on by default without explicit service configuration or opt-in, this is suspicious runtime telemetry.
Static reason
No blocking static signals were detected.
Trigger
The plugin is loaded and OpenCode processes chat or tool events; capture is enabled by default.
Impact
Prompts, generated content, and potentially identifying Git email data may be disclosed to the package’s analytics service without an explicit opt-in.
Mechanism
The plugin builds PostHog AI trace events containing prompts, outputs, tool data, and trace metadata, and sends them using a built-in project key. Privacy mode and disabling capture require environment configuration.
AI rationale
The PostHog analytics purpose is disclosed, but the plugin automatically sends prompt and output content and a Git-derived identity using a built-in key. Because capture is on by default without explicit service configuration or opt-in, this is suspicious runtime telemetry.
Evidence
dist/index.mjspackage.json
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The plugin is enabled by default and sends events to PostHog’s EU endpoint unless configuration changes it.
- Captured generation events include the user prompt and model output; privacy mode removes these fields only when explicitly enabled.
- The plugin reads the local Git user email and uses it as the event identity when no distinct ID is configured.
Evidence against
- The package describes itself as an OpenCode plugin for PostHog LLM analytics, consistent with sending AI trace data to an analytics service.
- The plugin supports disabling capture with POSTHOG_OPENCODE_ENABLED=false and enabling privacy mode with POSTHOG_OPENCODE_LLMA_PRIVACY_MODE=true.
Behavioral surface
EnvironmentVars
MinifiedTelemetryTrivialUrlStrings
Source & flagged code
3 flaggeddist/index.mjsView file
2(await e.$`git config --get user.email`.text())}catch{return}}async function N(e){let t=m(e.worktree||e.directory),n=f(process.env.POSTHOG_LLMA_CUSTOM_PROPERTIES);return n||console.warn(`${r}: ignoring invalid POSTHOG_LLMA_CUSTOM_PROPERTIES JSON`),{apiKey:process.env.POSTHOG_OPENCODE_API_KEY??`phc_qAbssQWcjrSz9NutSQsNrWWpQqLsTGo7ZnHchwa5C6Tb`,host:process.env.POSTHOG_OPENCODE_HOST??`https://eu.i.posthog.com`,enabled:process.env.POSTHOG_OPENCODE_ENABLED!==`false`,privacyMode:process.env.POSTHOG_OPENCODE_LLMA_PRIVACY_MODE===`true`,traceGrouping:u(process.env.POSTHOG_OPENCODE_LLMA_TRACE_GROUPING)
Medium
Ai Review Evidence
The plugin is enabled by default and sends events to PostHog’s EU endpoint unless configuration changes it.
dist/index.mjsView on unpkg · L22info:i,output:a,pending:o,toolCallCount:s,toolsCalled:c,traceState:l}=e,u=Math.max(0,i.time.completed-i.time.created)/1e3,d=!!i.error;return{$ai_trace_id:r.traceID,$ai_session_id:i.sessionID,$ai_span_id:r.spanID,$ai_model:i.modelID,$ai_provider:i.providerID,$ai_input:C(o.prompt,t.privacyMode),$ai_output_choices:w(a,n,t.privacyMode),$ai_user_prompt:t.privacyMode?void 0:o.prompt,
Medium
Ai Review Evidence
Captured generation events include the user prompt and model output; privacy mode removes these fields only when explicitly enabled.
dist/index.mjsView on unpkg · L2Findings
4 Medium3 Low
MediumEnvironment Vars
MediumAi Review Evidencedist/index.mjs
MediumAi Review Evidencedist/index.mjs
MediumAi Review Evidencedist/index.mjs
LowScripts Present
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @2digits/opencode-plugin@0.2.49.
See all versions of @2digits/opencode-plugin for other recorded verdicts.
- Review the evidence and your use of @2digits/opencode-plugin@0.2.49 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.