registry / @brainervirus/workit-opencode / 1.3.2
@brainervirus/workit-opencode@1.3.2
Workit OpenCode plugin — native tools, adaptive policy, and fourteen method skills
AI Security Review
scanned 21d ago · by lpm-firewall-aiInspected source supports ordinary workflow tooling and caller-configured service authentication, without install-time attack behavior. The scanner's gateway and command-output exfiltration claims were not substantiated by the inspected data flows.
Static reason
One or more suspicious static signals were detected.
Trigger
Plugin loading registers tools and hooks; tool invocation activates setup and service operations.
Impact
No malicious impact was identified; expected effects include local workflow configuration and authenticated YouTrack requests.
Mechanism
The plugin uses a locally supplied service token, runs repository commands, and guards setup with confirmation. No covert export or permission bypass was established.
AI rationale
Inspected source supports ordinary workflow tooling and caller-configured service authentication, without install-time attack behavior. The scanner's gateway and command-output exfiltration claims were not substantiated by the inspected data flows.
Evidence
youtrack.jsonyoutrack.tokenconfig.jsonvcs.json
Network endpoints2
enghouseamg.youtrack.cloudgitlab.com/api/v4
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has build and typecheck scripts, no install lifecycle hooks, and no runtime self-dependency.
- The plugin reads a user-configured YouTrack token file and pairs it with the configured service base URL.
- YouTrack requests send bearer authentication to service API routes; no unrelated credential recipient was identified.
- Setup creates a token placeholder and directs users to create a YouTrack token locally; configuration changes require confirmation.
- The shell permission hook preserves existing denials and adds branch-policy denials.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/plugin.jsView file
20// packages/workit-core/src/core.ts
L21: import { spawnSync as spawnSync3 } from "node:child_process";
L22: import { existsSync as existsSync5, realpathSync as realpathSync7 } from "node:fs";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/plugin.js:
fs3.writeFileSync(fd, raw, "utf8");
fs4.writeFileSync(this.gitignorePath, `*
return failure("permission_denied", "write authorization requires core state");
writeFileSync as writeFileSync2
writeFileSync2(path5.join(dir, "config.json"), JSON.stringify(config, null, 2) + `
youtrack: object({ baseUrl: nonBlank.optional(), link_issues: boolean2().optional() }).passthrough().optional(),
const youtrackBaseUrl = provider === "gitlab" && typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
youtrack_base_url: youtrackBaseUrl,
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/plugin.jsView on unpkg20// packages/workit-core/src/core.ts
L21: import { spawnSync as spawnSync3 } from "node:child_process";
L22: import { existsSync as existsSync5, realpathSync as realpathSync7 } from "node:fs";
...
L421: for (let i = 0;i < units - 1; i++) {
L422: if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {
L423: count--;
...
L847: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
L848: } : { success: true, data: result.value };
L849: };
...
L1722: try {
L1723: new URL(`http://[${value}]`);
L1724: return true;
Findings
3 High2 Medium7 Low
HighChild Processdist/plugin.js
HighCredential Redirect Persistencedist/plugin.js
HighCommand Output Exfiltrationdist/plugin.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/plugin.js
Affected versions and remediation
This report applies to @brainervirus/workit-opencode@1.3.2.
See all versions of @brainervirus/workit-opencode for other recorded verdicts.
- Review the evidence and your use of @brainervirus/workit-opencode@1.3.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.