AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package provides an OpenCode workflow plugin with powerful agent tools for browser automation, ClickUp/GitHub integration, and local configuration writes. These are high-risk capabilities but appear package-aligned and activated by plugin/tool/CLI use rather than install or import.
Static reason
One or more suspicious static signals were detected.
Trigger
OpenCode plugin load/config hook or explicit optima tool/bin invocation
Impact
A configured agent could mutate OpenCode agent config, drive a local Chrome/ChatGPT QA session, update ClickUp/GitHub state, or run user-supplied browser scripts.
Mechanism
AI workflow orchestration with browser scripting and configured SaaS/API mutations
Rationale
Static inspection found dangerous but explicit OpenCode plugin capabilities, not covert malware: no lifecycle execution, no import-time payload, and network/file writes match the package's workflow automation purpose. Because agent-exposed arbitrary browser scripting and OpenCode config writes create real risk if enabled, warn rather than block.
Evidence
package.jsonscripts/optima-sanitize-host.jsdist/sanitize_cli.jsdist/index.jsOPENCODE_CONFIG_DIR/agent/*.md.local/share/opencode/optima/**.optima/**configured worktree filesQA artifact screenshot paths
Network endpoints6
api.clickup.comapi.github.com127.0.0.1:3001127.0.0.1:9223chatgpt.comauth.openai.com
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- dist/index.js exposes optima_qa_chrome_command that runs user/agent supplied JS via new Function against Playwright/CDP browser pages.
- dist/index.js can connect to local Chrome DevTools at http://127.0.0.1:9223 and open/use https://chatgpt.com/ tabs.
- dist/index.js config hook writes generated OpenCode agent markdown under OPENCODE_CONFIG_DIR unless disabled.
- dist/index.js includes ClickUp and GitHub API clients that can update tasks, comments, PRs, refs, and repository contents when configured with tokens.
- dist/index.js can start/restart a configured user systemd service for QA Chrome when qa.autostart is enabled.
Evidence against
- package.json has no install/postinstall/preinstall lifecycle hook; prepack is publish-time only.
- dist/index.js exports an OpenCode plugin; risky actions are exposed as named runtime tools/config behavior, not import-time execution.
- Network endpoints are aligned with documented workflow integrations: ClickUp, GitHub, local OpenCode/CDP, and ChatGPT QA browser usage.
- scripts/optima-sanitize-host.js only imports the sanitize CLI; dist/sanitize_cli.js main runs only when invoked as the bin script.
- No credential harvesting or covert exfiltration path found beyond configured API tokens used for their matching services.
- No obfuscated strings, dropped binaries, persistence implant, dependency-confusion pattern, or destructive install-time behavior found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcedist/index.jsView file
9406import path5 from "node:path";
L9407: import { execFileSync } from "node:child_process";
L9408: function toGitPath(worktree, targetPath) {
High
14979if (!script.trim()) return { ok: false, error: "script_required" };
L14980: const fn = new Function("page", "context", "browser", "artifactsDir", `return (async () => {
L14981: ${script}
...
L14987: }
L14988: async function withQaBrowser({ provider = DEFAULT_QA_PROVIDER, cdpUrl = "", clickupTaskId = "", startUrl = "https://chatgpt.com/" } = {}, callback) {
L14989: const chromium = await loadPlaywrightChromium();
L14990: const browser = await chromium.connectOverCDP(normalizeCdpUrl(cdpUrl), {
L14991: timeout: Number(process.env.OPTIMA_QA_PLAYWRIGHT_CONNECT_TIMEOUT_MS || DEFAULT_QA_PLAYWRIGHT_CONNECT_TIMEOUT_MS)
L14992: });
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L1497914423const browser = {};
L14424: const fn = new Function("cdp", "target", "artifactsDir", "command", "page", "context", "browser", `return (async () => {
L14425: ${script}
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/index.jsView on unpkg · L14423scripts/optima-sanitize-host.jsView file
9const cliPath = fs.existsSync(sourceCli) ? sourceCli : distCli;
L10: const { main } = await import(cliPath);
L11:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/optima-sanitize-host.jsView on unpkg · L9dist/sanitize_cli.jsView file
2592Cross-file remote execution chain: dist/sanitize_cli.js spawns dist/index.js; helper contains network access plus dynamic code execution.
L2592: if (typeof node_buffer.Buffer === "function") {
L2593: return node_buffer.Buffer.from(src, "base64");
L2594: } else if (typeof atob === "function") {
...
L5197: yield* this.next(token);
L5198: yield* this.end(forceDoc, endOffset);
L5199: }
...
L5201: *next(token) {
L5202: if (node_process.env.LOG_STREAM)
L5203: console.dir(token, { depth: null });
...
L7491: // WTF!
L7492: // https://git-scm.com/docs/gitignore
L7493: // changes in [2.22.1](https://git-scm.com/docs/gitignore/2.22.1)
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/sanitize_cli.jsView on unpkg · L2592Findings
4 High3 Medium6 Low
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCross File Remote Execution Contextdist/sanitize_cli.js
MediumDynamic Requirescripts/optima-sanitize-host.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License