@brainervirus/workit-opencode@8.12.1
Workit OpenCode plugin — native tools, adaptive policy, and sixteen method skills
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe default YouTrack host is a placeholder, but the source also guides token creation from that base and sends the saved token there during issue lookup. Because the transfer is user-triggered and the base URL is configurable, this warrants a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.
Trigger
The user confirms YouTrack setup, supplies a token, and later requests YouTrack issue context.
Impact
If the user supplies a real YouTrack token while the placeholder base URL remains configured, the token may be disclosed to that endpoint.
Mechanism
The plugin reads a token from a local file and sends it as a bearer credential to an issue API URL built from the configured base URL, which defaults to youtrack.example.com.
AI rationale
The default YouTrack host is a placeholder, but the source also guides token creation from that base and sends the saved token there during issue lookup. Because the transfer is user-triggered and the base URL is configurable, this warrants a warning rather than a publish block.
Evidence
dist/plugin.jsyoutrack.jsonyoutrack.token
Network endpoints1
youtrack.example.com
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json points to dist/plugin.js as the runtime entry point and lists only build and typecheck scripts.
- The YouTrack scaffold defaults its base URL to https://youtrack.example.com and stores the token in a local token file.
- The scaffold guides the user to create a token and paste it into that token file.
- The runtime reads the token from the configured file and uses the configured base URL.
- The YouTrack issue request sends the token as a bearer credential to a URL derived from that base URL.
- The request occurs during YouTrack context lookup; setup file changes require explicit confirmation.
Evidence against
- The token transfer requires a YouTrack context lookup, and the base URL can be configured.
- The scaffold requires explicit confirmation before writing setup files.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
5 flagged · loading sourcedist/plugin.jsView file
6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync16 } from "node:child_process";
L8: import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/plugin.js:
decision: "Record or revoke a user decision (never an authorization).",
fs3.writeFileSync(fd, raw, "utf8");
"authorization",
(env) => env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE === "Codex Desktop" || env.CODEX_ELECTRON_RESOURCES_PATH ? "codex_desktop" : "codex_cli"
fs7.writeFileSync(path6.join(legacy, "tasks", name), bytes);
fs7.writeFileSync(ignore, `*
retryTransient(() => fs7.writeFileSync(ignore, `*
writeFileSync as writeFileSync2
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/plugin.jsView on unpkg6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync16 } from "node:child_process";
L8: import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
...
L396: for (let i = 0;i < units - 1; i++) {
L397: if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {
L398: count--;
...
L830: }
L831: return result.issues.length ? failure(_Err, result.issues, ctx) : { success: true, data: result.value };
L832: };
...
L1706: return false;
L1707: return canParseURL(`http://[${value}]`);
L1708: }
Findings
3 High4 Medium5 Low
HighChild Processdist/plugin.js
HighCredential Redirect Persistencedist/plugin.js
HighCommand Output Exfiltrationdist/plugin.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/plugin.js
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @brainervirus/workit-opencode@8.12.1.
See all versions of @brainervirus/workit-opencode for other recorded verdicts.
- Review the evidence and your use of @brainervirus/workit-opencode@8.12.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.