registry / @plannotator/opencode / 0.27.7
@plannotator/opencode@0.27.7
Plannotator plugin for OpenCode - interactive plan review with visual annotation
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malicious by source evidence, but automatic OpenCode configuration mutation plus default workflow control is a user-visible lifecycle risk. Warn rather than block under the first-party agent-extension policy.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm postinstall; subsequently loading the OpenCode plugin or invoking its Plannotator review commands.
Impact
Persistent OpenCode command/skill availability and workflow/prompt changes; runtime execution of the configured Plannotator CLI.
Mechanism
first-party OpenCode extension setup and plan-review workflow integration
AI rationale
This is not malicious by source evidence, but automatic OpenCode configuration mutation plus default workflow control is a user-visible lifecycle risk. Warn rather than block under the first-party agent-extension policy.
Evidence
package.jsondist/index.jsdist/embedded.jsskills/plannotator/SKILL.mdcommands/plannotator-annotate.mdcommands/plannotator-last.mdcommands/plannotator-review.md${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands${XDG_CONFIG_HOME:-$HOME/.config}/opencode/skills/plannotator
Network endpoints1
r.jina.ai/
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- postinstall automatically copies commands and a Plannotator skill into the user OpenCode configuration.
- The default plugin workflow mutates OpenCode agent/tool configuration and injects plan-review prompts.
- Runtime can launch the configured plannotator executable, including a PLANNOTATOR_BIN override.
Evidence against
- No credential harvesting, covert exfiltration, eval, or shell-enabled child process was found.
- Network fetching is tied to user-requested URL annotation; Jina use is explicit in the implementation.
- Installed files are package-aligned Plannotator commands and skill content, not a foreign agent configuration takeover.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = mkdir -p ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands && cp ./commands/*.md ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands/ 2>/dev/null || true; mkdir -p ${XDG_CONFIG_H...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = mkdir -p ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands && cp ./commands/*.md ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands/ 2>/dev/null || true; mkdir -p ${XDG_CONFIG_H...
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/server.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @plannotator/opencode@0.27.4
matchedIdentity = npm:QHBsYW5ub3RhdG9yL29wZW5jb2Rl:0.27.4
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Findings
2 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/server.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/server.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/embedded.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @plannotator/opencode@0.27.7.
See all versions of @plannotator/opencode for other recorded verdicts.
- Review the evidence and your use of @plannotator/opencode@0.27.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.