@brainervirus/workit-opencode@8.1.1
Workit OpenCode plugin — native tools, adaptive policy, and sixteen method skills
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe source supports conditional forwarding of a stored YouTrack token to an operator-configured destination without a visible allowlist. The default destination and package-aligned integration reduce concern, and the evidence does not establish malicious exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
An OpenCode session invokes a plugin feature that makes a YouTrack request while a token is configured.
Impact
A misconfigured or operator-controlled unrelated destination could receive the YouTrack token; the inspected source does not establish a hidden default recipient or a silent destination override.
Mechanism
The plugin reads the token file, uses the configured base URL, adds the token as a Bearer header, and sends the request without a shown destination allowlist.
AI rationale
The source supports conditional forwarding of a stored YouTrack token to an operator-configured destination without a visible allowlist. The default destination and package-aligned integration reduce concern, and the evidence does not establish malicious exfiltration.
Evidence
dist/plugin.js
Network endpoints1
youtrack.example.com
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package entrypoint is the plugin bundle, and package.json declares no install lifecycle hook.
- The bundle reads a YouTrack token from a local token file and accepts a configurable base URL without showing a destination allowlist.
- The request code places the token in a Bearer authorization header and sends it with fetch.
- The bundle also runs subprocesses and returns their output, but the inspected excerpt does not show that output being sent with the token.
Evidence against
- The default YouTrack endpoint is a YouTrack host, and the request path is consistent with a YouTrack integration.
- The bundle is activated as an OpenCode plugin; the cited command execution excerpt alone does not establish data exfiltration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/plugin.jsView file
6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync14 } from "node:child_process";
L8: import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
High
6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync14 } from "node:child_process";
L8: import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
...
L396: for (let i = 0;i < units - 1; i++) {
L397: if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {
L398: count--;
...
L830: }
L831: return result.issues.length ? failure(_Err, result.issues, ctx) : { success: true, data: result.value };
L832: };
...
L1706: return false;
L1707: return canParseURL(`http://[${value}]`);
L1708: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/plugin.jsView on unpkg · L618152const token = fs14.readFileSync(tokenPath, "utf8").trim();
if (!token)
return { error: "empty token file" };
if (token === TOKEN_PLACEHOLDER || token.startsWith(TOKEN_PLACEHOLDER)) {
return {
error: "token file still has placeholder YOUR_TOKEN_HERE — edit the file locally, then run /wk-status"
};
}
const base = String(loaded.config.baseUrl ?? "").replace(/\/+$/, "");
if (!base)
return { error: "baseUrl missing in
Findings
2 High5 Medium5 Low
HighChild Processdist/plugin.js
HighCommand Output Exfiltrationdist/plugin.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/plugin.js
MediumAi Review Evidencedist/plugin.js
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @brainervirus/workit-opencode@8.1.1.
See all versions of @brainervirus/workit-opencode for other recorded verdicts.
- Review the evidence and your use of @brainervirus/workit-opencode@8.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.