registry / @brainervirus/workit-opencode / 1.0.11

@brainervirus/workit-opencode@1.0.11

Workit OpenCode plugin — native tools, adaptive policy, and fourteen method skills

AI Security Review

scanned 21d ago · by lpm-firewall-ai

The flagged execution and network primitives implement workflow operations and configured service authentication, with native approval checks for external actions. Source inspection found no concrete malicious chain or unresolved risk warranting a warning.

Static reason

One or more suspicious static signals were detected.

Trigger

Loading the plugin and invoking its workflow tools activates these behaviors; npm installation has no lifecycle trigger.

Impact

Inspected behavior supports repository workflows and agent coordination; no covert credential export or malicious installation mutation was established.

Mechanism

The plugin runs Git and hosting tools, authenticates with configured service tokens, and registers skills through host callbacks.

AI rationale

Evidence

youtrack.tokenyoutrack.json

Network endpoints3

api.github.comgitlab.comenghouseamg.youtrack.cloud

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has build and typecheck scripts, no installation lifecycle hooks, and no runtime self-dependency.
Command execution uses executable arguments and a repository working directory for workflow operations.
External actions require approved decisions with host-observed receipts and successful action reservation.
YouTrack setup creates a token placeholder without overwriting an existing file; authentication uses the configured service base.
The loaded plugin registers its skills through the host configuration callback.
Pull request verification checks the approved repository remote and API host before reading its configured token.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

dist/plugin.jsView file

21// packages/workit-core/src/core.ts L22: import { spawnSync as spawnSync2 } from "node:child_process"; L23: import { existsSync as existsSync4, realpathSync as realpathSync5 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/plugin.jsView on unpkg · L21

21// packages/workit-core/src/core.ts L22: import { spawnSync as spawnSync2 } from "node:child_process"; L23: import { existsSync as existsSync4, realpathSync as realpathSync5 } from "node:fs"; ... L422: for (let i = 0;i < units - 1; i++) { L423: if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) { L424: count--; ... L848: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L849: } : { success: true, data: result.value }; L850: }; ... L1723: try { L1724: new URL(`http://[${value}]`); L1725: return true;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/plugin.jsView on unpkg · L21

13620function run(root, executable, args, env = {}) { const cwd = realpathSync5(root); const result = spawnSync2(executable, args, { cwd, encoding: "utf8", env: { ...process.env, ...env } }); return { exitCod

Low

Ai Review Evidence

Command execution uses executable arguments and a repository working directory for workflow operations.

dist/plugin.jsView on unpkg · L13620

9837if (decision.response !== "approved") return failure("permission_denied", "decision was rejected"); if (entry.provenance.kind !== "host_observed" || entry.provenance.receipts.length === 0 || !provenanceMatches(entry.provenance, authority.provenance)) return failure("permission_denied", "action approval lacks native receipt assurance"); if (decision.rev

Low

Ai Review Evidence

External actions require approved decisions with host-observed receipts and successful action reservation.

dist/plugin.jsView on unpkg · L9837

package.jsonView file

Lines 16-50json

16 "bugs": {

17 "url": "https://github.com/BrainerVirus/workit/issues"

18 },

19 "license": "MIT",

20 "repository": {

21 "type": "git",

Source & flagged code

5 flagged · loading source

dist/plugin.jsView file

21// packages/workit-core/src/core.ts L22: import { spawnSync as spawnSync2 } from "node:child_process"; L23: import { existsSync as existsSync4, realpathSync as realpathSync5 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/plugin.jsView on unpkg · L21

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/plugin.jsView on unpkg · L21

Findings

3 High2 Medium7 Low

HighChild Processdist/plugin.js

HighShell

HighCommand Output Exfiltrationdist/plugin.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/plugin.js

Affected versions and remediation

This report applies to @brainervirus/workit-opencode@1.0.11.

See all versions of @brainervirus/workit-opencode for other recorded verdicts.

Review the evidence and your use of @brainervirus/workit-opencode@1.0.11 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-01 22:34:05.179Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.