registry / @plannotator/opencode / 0.27.14
@plannotator/opencode@0.27.14
Plannotator plugin for OpenCode - interactive plan review with visual annotation
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package creates an automatic AI-agent command surface during installation, so it warrants a warning. Its scope is package-owned OpenCode integration and the inspected source does not show a concrete malicious payload.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm installation, then use of an installed OpenCode command.
Impact
An AI agent may execute the package CLI on supplied targets without a separate user confirmation.
Mechanism
Postinstall agent-extension registration and agent-directed CLI execution.
AI rationale
The package creates an automatic AI-agent command surface during installation, so it warrants a warning. Its scope is package-owned OpenCode integration and the inspected source does not show a concrete malicious payload.
Evidence
package.jsoncommands/plannotator-annotate.mdcommands/*.mdskills/plannotator/SKILL.md${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands/${XDG_CONFIG_HOME:-$HOME/.config}/opencode/skills/plannotator/
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The automatic postinstall hook copies command and skill files into the user's OpenCode configuration directory.
- An installed command instructs an AI agent to run the plannotator executable with Bash without asking the user.
Evidence against
- The install hook writes only package-named OpenCode commands and a package-owned skill, not arbitrary project files.
- The inspected runtime CLI launch disables shell execution.
- No credential harvesting, secret exfiltration, self-dependency, or remote payload download was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = mkdir -p ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands && cp ./commands/*.md ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands/ 2>/dev/null || true; mkdir -p ${XDG_CONFIG_H...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = mkdir -p ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands && cp ./commands/*.md ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands/ 2>/dev/null || true; mkdir -p ${XDG_CONFIG_H...
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/server.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @plannotator/opencode@0.27.12
matchedIdentity = npm:QHBsYW5ub3RhdG9yL29wZW5jb2Rl:0.27.12
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Findings
2 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/server.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/server.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/embedded.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @plannotator/opencode@0.27.14.
See all versions of @plannotator/opencode for other recorded verdicts.
- Review the evidence and your use of @plannotator/opencode@0.27.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.