registry  /  @skj1724/oh-my-opencode  /  4.1.7

@skj1724/oh-my-opencode@4.1.7

The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNativeBindingsNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 5 file(s), 1.18 MB of source, external domains: bun.sh, cli.github.com, github.com, json-schema.org, opencode.ai, raw.githubusercontent.com, registry.npmjs.org, zod.dev
Oversized source lightweight scan
dist/index.js2.89 MB file, sampled 256 KB
FilesystemChildProcessEnvironmentVarsUrlStringszod.dev

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/cli/index.jsView file
52class CommanderError extends Error { L53: constructor(exitCode, code, message) { L54: super(message); ... L770: var EventEmitter = __require("events").EventEmitter; L771: var childProcess = __require("child_process"); L772: var path = __require("path"); ... L816: this._outputConfiguration = { L817: writeOut: (str) => process2.stdout.write(str), L818: writeErr: (str) => process2.stderr.write(str), ... L2495: const input = source.replace(/\s/g, ""); L2496: if (input.length % 4 !== 0 || !BASE64_PATTERN.test(input)) L2497: return NOT_RESOLVED;
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L52
dist/index.jsView file
•path = dist/index.js kind = oversized_source_file sizeBytes = 3027078 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

Findings

3 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitydist/cli/index.js
HighOversized Source Filedist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings