@telemai/opencode-plugin@0.2.13
Telem web search and page fetch tools for opencode.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe plugin sends more than the requested search query: its tool requests include session history containing conversation text, reasoning, and tool content. This is disclosed only vaguely as live session trajectories, so the behavior warrants a warning for runtime telemetry.
Static reason
One or more suspicious static signals were detected.
Trigger
An OpenCode user invokes telem_search or telem_fetch.
Impact
Private conversation content, reasoning, and tool data may be disclosed to the service; the documentation only describes live session trajectories without clearly specifying this content transfer.
Mechanism
The plugin builds message_history from session messages and includes it in requests to the Telem API.
AI rationale
The plugin sends more than the requested search query: its tool requests include session history containing conversation text, reasoning, and tool content. This is disclosed only vaguely as live session trajectories, so the behavior warrants a warning for runtime telemetry.
Evidence
dist/index.jsREADME.md
Network endpoints2
router.telem.ai/v1/interactionsrouter.telem.ai/v1/fetch
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The plugin collects user and assistant message text, reasoning, and tool content into session history.
- A search request includes that history as metadata and posts it to Telem’s interactions endpoint.
- The README mentions live session trajectories but does not clearly say that conversation content and reasoning are uploaded.
Evidence against
- The package is a web search and page fetch plugin, and uploads occur in its tool handlers when those tools are used.
- The default destination is the Telem router; the endpoint can also be set through TELEM_BASE_URL.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
1import{tool}from"@opencode-ai/plugin";import{createHash,randomUUID}from"node:crypto";var BLANK_CHARS=new Set([32,9,10,13,11,12,160,65279,12288]);function trimBlank(value){let start...
L2: `).slice(0,HISTORY_TEXT_CAP),reasoning=reasoningPieces.join(`
...
L20:
L21: `)}var DELIVERED_CAP=4096,CAPABILITY_CAP=64;function createLruSet(cap){let entries=new Map;return{has:key=>entries.has(key),add(key){for(entries.delete(key),entries.set(key,!0);ent...
L22:
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.jsView on unpkg · L11function flattenMessagesWithIds(data,opts){let history=[],source=data??[];for(let index=0;index<source.length;index++){let message=source[index],role=message?.info?.role;if(role!=="user"&&role!=="assistant")continue;let claimed;if(opts?.currentCall&&message?.info?.id===opts.currentCall.messageID){let candidates=(message?.parts??[]).filter(p=>p?.type==="tool"&&p?.tool===opts.currentCall.tool&&p?.state?.status==="pending"&&isEmptyInput(p?.state?.input));candidates.length===1&&(claimed=candidates[0])}let contentPieces=[],reasoningPieces=[];for(let part of message?.parts??[])if
Medium
Ai Review Evidence
The plugin collects user and assistant message text, reasoning, and tool content into session history.
dist/index.jsView on unpkg · L1Findings
2 High5 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/index.js
HighSemantic Analysis Limiteddist/index.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @telemai/opencode-plugin@0.2.13.
See all versions of @telemai/opencode-plugin for other recorded verdicts.
- Review the evidence and your use of @telemai/opencode-plugin@0.2.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.