registry / @mouyox21/opencode-agents / 1.1.0

@mouyox21/opencode-agents@1.1.0

A comprehensive collection of 259 specialized AI agents for OpenCode — with CLI, registry, and Agent Package Manager

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit CLI installation or update can place remotely fetched agent prompts into project or global OpenCode agent directories. No automatic install-time mutation or confirmed exfiltration is present.

Static reason

No blocking static signals were detected.

Trigger

User runs `opencode-agents install` or `opencode-agents update`.

Impact

A changed upstream raw Markdown file could alter installed OpenCode agent behavior.

Mechanism

Unverified remote prompt download followed by agent-config file write.

Rationale

No concrete malicious behavior was found, but the unverified remote prompt-to-agent-config pipeline is a meaningful agent-extension supply-chain risk. It warrants a warning rather than a block.

Evidence

package.jsonpackages/cli/bin/cli.jspackages/core/config.jspackages/core/downloader.jspackages/core/installer.jspackages/core/updater.jspackages/core/registry.js.opencode/agents/<agentName>.md~/.config/opencode/agents/<agentName>.md

Network endpoints1

raw.githubusercontent.com/mouyox21/opencode-agents/main/<agentName>.md

@mouyox21/opencode-agents@1.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code