registry / @brainervirus/workit-opencode / 8.14.0
@brainervirus/workit-opencode@8.14.0
Workit OpenCode plugin — native tools, adaptive policy, and sixteen method skills
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe manifest has no install hook, and the inspected credential flow is tied to requested YouTrack issue context using a configurable service host. The scanner’s credential-transfer signal does not establish an attack because the scaffold default is a placeholder and setup requires confirmation.
Static reason
One or more suspicious static signals were detected.
Trigger
A YouTrack context request for a selected issue triggers the API request; setup changes require confirmation.
Impact
No concrete credential theft or unrelated data transfer was established.
Mechanism
The plugin reads a token from a local file and sends it to the configured YouTrack base URL. The scaffold default is a placeholder host, and setup accepts a base URL argument.
AI rationale
The manifest has no install hook, and the inspected credential flow is tied to requested YouTrack issue context using a configurable service host. The scanner’s credential-transfer signal does not establish an attack because the scaffold default is a placeholder and setup requires confirmation.
Evidence
package.jsondist/plugin.js
Network endpoints1
youtrack.example.com
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports dist/plugin.js and lists only build and typecheck scripts; no install lifecycle hook is declared.
- The plugin reads the YouTrack token from a local configured token file.
- YouTrack requests send the token as a bearer credential to a supplied URL.
- The YouTrack context request runs when that context is requested for a selected issue.
- The scaffold host is configurable; its default is the placeholder youtrack.example.com, and setup requires confirmation.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/plugin.jsView file
6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync16 } from "node:child_process";
L8: import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/plugin.js:
decision: "Record or revoke a user decision (never an authorization).",
fs3.writeFileSync(fd, raw, "utf8");
"authorization",
(env) => env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE === "Codex Desktop" || env.CODEX_ELECTRON_RESOURCES_PATH ? "codex_desktop" : "codex_cli"
fs8.writeFileSync(path8.join(legacy, "tasks", name), bytes);
fs8.writeFileSync(ignore, `*
retryTransient(() => fs8.writeFileSync(ignore, `*
writeFileSync as writeFileSync2
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/plugin.jsView on unpkg6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync16 } from "node:child_process";
L8: import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
...
L396: for (let i = 0;i < units - 1; i++) {
L397: if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {
L398: count--;
...
L830: }
L831: return result.issues.length ? failure(_Err, result.issues, ctx) : { success: true, data: result.value };
L832: };
...
L1706: return false;
L1707: return canParseURL(`http://[${value}]`);
L1708: }
Findings
3 High2 Medium7 Low
HighChild Processdist/plugin.js
HighCredential Redirect Persistencedist/plugin.js
HighCommand Output Exfiltrationdist/plugin.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @brainervirus/workit-opencode@8.14.0.
See all versions of @brainervirus/workit-opencode for other recorded verdicts.
- Review the evidence and your use of @brainervirus/workit-opencode@8.14.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.