@telemai/opencode-plugin
Telem web search and page fetch tools for opencode.
This report shows the evidence for @telemai/opencode-plugin@0.2.13. 0 of 8 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe plugin sends more than the requested search query: its tool requests include session history containing conversation text, reasoning, and tool content. This is disclosed only vaguely as live session trajectories, so the behavior warrants a warning for runtime telemetry.
Decision evidence
public snapshot- The plugin collects user and assistant message text, reasoning, and tool content into session history.
- A search request includes that history as metadata and posts it to Telem’s interactions endpoint.
- The README mentions live session trajectories but does not clearly say that conversation content and reasoning are uploaded.
- The package is a web search and page fetch plugin, and uploads occur in its tool handlers when those tools are used.
- The default destination is the Telem router; the endpoint can also be set through TELEM_BASE_URL.
Source & flagged code
5 flaggedSource gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.jsView on unpkg · L1The plugin collects user and assistant message text, reasoning, and tool content into session history.
dist/index.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @telemai/opencode-plugin@0.2.13.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @telemai/opencode-plugin@0.2.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.