@brainervirus/workit-opencode@8.5.0
Workit OpenCode plugin — native tools, adaptive policy, and sixteen method skills
AI Security Review
scanned 15d ago · by lpm-firewall-aiStatic inspection found a conditional credential exposure risk: YouTrack credentials are sent to a configurable base URL without an apparent destination allowlist. This warrants a warning, but the inspected code does not establish covert exfiltration or malicious intent.
Static reason
One or more suspicious static signals were detected.
Trigger
A caller invokes the plugin’s YouTrack issue-fetch capability with a configured token and base URL.
Impact
If configuration points to an unintended server, the YouTrack token could be exposed there; no evidence shows the package silently selects such a destination.
Mechanism
The plugin reads the configured token file, places the token in a bearer Authorization header, and fetches issue details from the configured base URL.
AI rationale
Static inspection found a conditional credential exposure risk: YouTrack credentials are sent to a configurable base URL without an apparent destination allowlist. This warrants a warning, but the inspected code does not establish covert exfiltration or malicious intent.
Evidence
dist/plugin.jspackage.json
Network endpoints1
youtrack.example.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- YouTrack reads a token from a configured token file and uses it in an Authorization header.
- The YouTrack API base URL is configurable, with no destination allowlist shown in the inspected request path.
- The token-bearing request is used to fetch issue details; no malicious collection or unrelated data transfer was established.
Evidence against
- package.json has no install lifecycle hook and exports the plugin entrypoint.
- The inspected subprocess helper runs commands in a selected repository root and returns command output to its caller.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/plugin.jsView file
6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync14 } from "node:child_process";
L8: import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
High
6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync14 } from "node:child_process";
L8: import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
...
L396: for (let i = 0;i < units - 1; i++) {
L397: if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {
L398: count--;
...
L830: }
L831: return result.issues.length ? failure(_Err, result.issues, ctx) : { success: true, data: result.value };
L832: };
...
L1706: return false;
L1707: return canParseURL(`http://[${value}]`);
L1708: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/plugin.jsView on unpkg · L618607var youTrackToken = () => {
const loaded = readYouTrackConfig(true);
if ("error" in loaded)
return loaded;
const tokenFile = String(loaded.config.tokenFile ?? "");
const tokenPath = tokenFile ? path18.isAbsolute(tokenFile) ? path18.resolve(tokenFile) : path18.resolve(
Findings
2 High5 Medium5 Low
HighChild Processdist/plugin.js
HighCommand Output Exfiltrationdist/plugin.js
MediumNetwork
MediumEnvironment Vars
MediumStripped Provenance Metadatapackage.json
MediumStripped Provenance Metadatadist/plugin.js
MediumAi Review Evidencedist/plugin.js
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @brainervirus/workit-opencode@8.5.0.
See all versions of @brainervirus/workit-opencode for other recorded verdicts.
- Review the evidence and your use of @brainervirus/workit-opencode@8.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.