@brainervirus/workit-opencode@8.9.0
Workit OpenCode plugin — native tools, adaptive policy, and sixteen method skills
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe configured YouTrack base URL is not restricted in the inspected token request path, so the local token could be sent to an unintended endpoint. This supports a warning for conditional credential exposure, but does not establish covert theft or a malicious default destination.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes a YouTrack operation through the loaded plugin.
Impact
If configured with an unintended destination, the token could be exposed to that endpoint; no such destination is established by the inspected source.
Mechanism
The plugin reads a token file, takes the configured base URL, and sends the token in an Authorization bearer header.
AI rationale
The configured YouTrack base URL is not restricted in the inspected token request path, so the local token could be sent to an unintended endpoint. This supports a warning for conditional credential exposure, but does not establish covert theft or a malicious default destination.
Evidence
dist/plugin.js
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The entrypoint is an OpenCode plugin, with no npm lifecycle hook shown in the manifest.
- The plugin reads a YouTrack token from a configured token file and accepts a configured base URL.
- The request sends that token as a bearer credential to the supplied URL.
Evidence against
- The token flow is part of the plugin's YouTrack integration and requires a local token file.
- No source evidence inspected shows a default unrelated recipient or an automatic install-time action.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/plugin.jsView file
6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync14 } from "node:child_process";
L8: import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
High
6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync14 } from "node:child_process";
L8: import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
...
L396: for (let i = 0;i < units - 1; i++) {
L397: if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {
L398: count--;
...
L830: }
L831: return result.issues.length ? failure(_Err, result.issues, ctx) : { success: true, data: result.value };
L832: };
...
L1706: return false;
L1707: return canParseURL(`http://[${value}]`);
L1708: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/plugin.jsView on unpkg · L618607var youTrackToken = () => {
const loaded = readYouTrackConfig(true);
if ("error" in loaded)
return loaded;
const tokenFile = String(loaded.config.tokenFile ?? "");
const tokenPath = tokenFile ? path18.isAbsolute(tokenFile) ? path18.resolve(tokenFile) : path18.resolve(process.cwd(), tokenFile) : "";
if (!tokenPath || !fs14.existsSync(tokenPath))
return { error: "missing youtrack.token" };
if (!youTrackTokenModeOk(tokenPath))
return { error: "y
Findings
2 High5 Medium5 Low
HighChild Processdist/plugin.js
HighCommand Output Exfiltrationdist/plugin.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/plugin.js
MediumAi Review Evidencedist/plugin.js
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @brainervirus/workit-opencode@8.9.0.
See all versions of @brainervirus/workit-opencode for other recorded verdicts.
- Review the evidence and your use of @brainervirus/workit-opencode@8.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.