@brainervirus/workit-opencode@8.15.1
Workit OpenCode plugin — native tools, adaptive policy, and sixteen method skills
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe authenticated YouTrack request can send a saved service token to an unrestricted configured destination, creating conditional credential exposure. The transfer is tied to YouTrack context use, so the evidence supports a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
A YouTrack context read with a saved token and configured base URL.
Impact
Conditional exposure of a YouTrack token to the selected destination; the source does not establish that the default example host receives a real token.
Mechanism
The integration reads the token and sends it in an Authorization bearer header to the configured URL.
AI rationale
The authenticated YouTrack request can send a saved service token to an unrestricted configured destination, creating conditional credential exposure. The transfer is tied to YouTrack context use, so the evidence supports a warning rather than a block.
Evidence
dist/plugin.js
Network endpoints2
youtrack.example.comconfigured YouTrack base URL
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- YouTrack credentials are read from a local token file alongside the configured base URL.
- The YouTrack request sends that token as a bearer credential to the configured URL without restricting its destination.
- Reading YouTrack context can trigger the authenticated issue request; the base URL can be supplied during initialization and otherwise defaults to an example host.
Evidence against
- The package has no install lifecycle hook; the credential transfer is tied to an explicit context read when YouTrack is configured.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/plugin.jsView file
6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync16 } from "node:child_process";
L8: import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/plugin.js:
decision: "Record or revoke a user decision (never an authorization).",
fs3.writeFileSync(fd, raw, "utf8");
"authorization",
(env) => env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE === "Codex Desktop" || env.CODEX_ELECTRON_RESOURCES_PATH ? "codex_desktop" : "codex_cli"
fs8.writeFileSync(path8.join(legacy, "tasks", name), bytes);
fs8.writeFileSync(ignore, `*
retryTransient(() => fs8.writeFileSync(ignore, `*
writeFileSync as writeFileSync2
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/plugin.jsView on unpkg6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync16 } from "node:child_process";
L8: import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
...
L396: for (let i = 0;i < units - 1; i++) {
L397: if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {
L398: count--;
...
L830: }
L831: return result.issues.length ? failure(_Err, result.issues, ctx) : { success: true, data: result.value };
L832: };
...
L1706: return false;
L1707: return canParseURL(`http://[${value}]`);
L1708: }
Findings
3 High4 Medium5 Low
HighChild Processdist/plugin.js
HighCredential Redirect Persistencedist/plugin.js
HighCommand Output Exfiltrationdist/plugin.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencedist/plugin.js
MediumAi Review Evidencedist/plugin.js
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @brainervirus/workit-opencode@8.15.1.
See all versions of @brainervirus/workit-opencode for other recorded verdicts.
- Review the evidence and your use of @brainervirus/workit-opencode@8.15.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.