registry / AI-agent control-surface risk / @dv.nghiem/flowdeck

@dv.nghiem/flowdeck

FlowDeck — structured planning and execution workflows for OpenCode

This report shows the evidence for @dv.nghiem/flowdeck@0.7.0-alpha.5. 1 of 4 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package performs unconsented postinstall mutation of a foreign AI-agent configuration and enables external agent control channels. This meets the firewall blocking boundary even though some functionality is documented.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation with lifecycle scripts enabled; subsequent OpenCode plugin load.

Impact

Activates a third-party agent plugin, changes default agent selection, and configures remote MCP channels that may receive configured API credentials.

Mechanism

unconsented OpenCode config mutation plus install-time remote code acquisition

Policy narrative

Installing the package runs postinstall.mjs without an explicit FlowDeck command. It creates or rewrites OpenCode's user configuration to enable the package and select its orchestrator. The lifecycle hook can clone Git source, install Rust via a downloaded installer, and compile/install fdx. When OpenCode loads the plugin, dist/index.js adds enabled remote MCP services, attaching Context7, Exa, and GitHub credentials when those environment variables exist.

AI rationale

Evidence

package.jsonpostinstall.mjsdist/index.jsbin/flowdeck.js~/.config/opencode/opencode.json$OPENCODE_CONFIG_DIR/opencode.json~/.local/share/flowdeck~/.cargo/bin/fdx~/.rustup-init.exe

Network endpoints7

github.com/DVNghiem/FlowDeck.gitwin.rustup.rs/x86_64

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall automatically.
postinstall.mjs writes the user OpenCode config and registers this plugin.
postinstall.mjs sets default_agent to orchestrator without consent.
postinstall.mjs clones remote Git code and builds/installs fdx during install.
dist/index.js injects enabled remote MCP endpoints and credential headers into OpenCode config.

Evidence against

The package identifies its OpenCode integration in source and documentation.
CLI configuration mutation is explicit when the user invokes bin/flowdeck.js.
No direct credential-file harvesting or arbitrary data exfiltration was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 257 KB of source, external domains: api.githubcopilot.com, expressjs.com, github.com, mcp.exa.ai, mcp.grep.app, opencode.ai, rustup.rs, sh.rustup.rs, win.rustup.rs, zod.dev

Source & flagged code

10 flagged

package.jsonView file

Lines 11-51json

11 "import": "./dist/index.js"

12 }

13 },

14 "bin": {

15 "flowdeck": "./bin/flowdeck.js"

16 },

17 "files": [

18 "dist",

19 "bin",

20 "src/commands",

21 "src/rules",

22 "src/skills",

23 "docs",

24 "postinstall.mjs"

25 ],

26 "scripts": {

27 "clean": "rm -rf dist",

28 "build": "bun build src/index.ts --outdir dist --target node --format esm --external @opencode-ai/plugin --external @opencode-ai/sdk && tsc --emitDeclarationOnly --project tsconfig.build.json",

29 "build:fdx": "cargo install --path crates/fdx --quiet",

30 "check:fdx": "fdx --version",

31 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "prepublishOnly": "bun run clean && bun run build",

33 "test": "bun test",

34 "typecheck": "tsc --noEmit",

35 "validate:skills": "node scripts/validate-skills.mjs",

36 "validate:docs": "node scripts/validate-docs.mjs"

37 },

38 "keywords": [

39 "opencode",

40 "plugin",

41 "ai",

42 "workflow",

43 "planning"

44 ],

45 "author": "DVNghiem",

46 "license": "MIT",

47 "repository": {

48 "type": "git",

49 "url": "git+https://github.com/DVNghiem/FlowDeck.git"

50 },

51 "bugs": {

dist/index.jsView file

Lines 1040-1080javascript

1040 let mockDb: MockDatabase;

1041

1042 beforeEach(() => {

1043 mockDb = createMockDb();

1044 service = new

postinstall.mjsView file

Lines 1-28javascript

1// postinstall.mjs

2// Runs after `npm install @dv.nghiem/flowdeck`

3// Only registers the plugin in opencode.json — agents/skills come from the npm package

5import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync, createWriteStream } from "node:fs";

6import { join, dirname } from "node:path";

7import { homedir }

bin/flowdeck.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { readfilesync, writefilesync, existssync, mkdirsync } from "node:fs"; import { join, dirname } from "node:path"; import { homedir } from "node:os"; import { fileurltopath } from "node:url"; const __dirname = dirname(fileurltopath(import.meta.url)); const pkgroot = join(__dirname, ".."); const args = process.argv.slice(2); if (args.includes("--help") || args.includes("-h") || args.includes("help")) { console.log(` flowdeck — structured planning and execution workflows for opencode usage: npx @dv.nghiem/flowdeck install flowdeck globally (~/.config/open

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/flowdeck.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

3534import { homedir as homedir3 } from "os"; L3535: import { execFileSync } from "node:child_process"; L3536:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L3534

Findings

1 Critical6 High5 Medium6 Low

CriticalAi Agent Control Hijackpostinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighShellpostinstall.mjs

HighSame File Env Network Executionpostinstall.mjs

HighSandbox Evasion Gated Capabilitypostinstall.mjs

HighExternal Ai Agent Control Surface Mutationbin/flowdeck.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

Affected versions and remediation

This report applies to @dv.nghiem/flowdeck@0.7.0-alpha.5.

The versions list below shows the verdict for each recorded version.

Avoid installing @dv.nghiem/flowdeck@0.7.0-alpha.5. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-11 01:35:39.974Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

0.7.0-alpha.5latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 10, 2026, 6:04 AM 0.6.1SuspiciousAgent extension lifecycle riskWarnPublishedJul 13, 2026, 2:54 AM 0.6.0Suspicious—WarnUnder ReviewJul 1, 2026, 3:45 AM 0.6.0-alpha.9Suspicious—WarnUnder Review

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages