registry / oh-my-opencode / 5.0.0
oh-my-opencode@5.0.0
⚠ Under reviewThe Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected install and agent-hint sources show scoped cache cleanup, not a concrete attack, so a warning or block is not justified. mark_clean is unavailable because 14 required citations exceed the 8-citation limit.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm postinstall runs node postinstall.mjs. A clean verdict is blocked by citation capacity, not by a proven attack.
Impact
No confirmed compromise, exfiltration, or unconsented foreign agent-config mutation. The review stays unresolved only because mark_clean citation coverage cannot fit.
Mechanism
The hook deletes cache directories named for oh-my-opencode or oh-my-openagent and does not install a foreign agent control surface. Remaining required paths cannot all be cited.
AI rationale
Inspected install and agent-hint sources show scoped cache cleanup, not a concrete attack, so a warning or block is not justified. mark_clean is unavailable because 14 required citations exceed the 8-citation limit.
Decision evidence
public snapshotAI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json postinstall runs node postinstall.mjs during npm install.
- That hook only removes OpenCode cache directories whose names start with oh-my-opencode@ or oh-my-openagent@ and does not write agent configuration.
- optionalDependencies are same-version platform packages, not another release of oh-my-opencode.
- The flagged .codex paths are in a QA script that expects those request contexts to be rejected.
- A clean record would need 14 distinct citations, above the 8-citation limit, and no independent attack behavior was found.
Evidence against
- The postinstall cache deletion is scoped to this package's own OpenCode plugin cache prefixes.
- No self-dependency selects an older lifecycle-enabled release of oh-my-opencode.
- No credential send, remote payload, or foreign agent-config write was found in the install hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
23 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L57: "docs/reference/web-terminal-visual-qa.md",
L58: ".opencode/command",
L59: ".opencode/skills",
L60: ".agents/command",
L61: ".agents/skills",
L62: "packages/lsp-tools-mcp/package.json",
...
L92: "packages/prompts-core/prompts/ultrawork/codex.md",
L93: "packages/omo-codex/plugin/.codex-plugin",
L94: "!packages/omo-codex/plugin/node_modules",
...
L142: "test:fast": "bun run script/test-fast.ts",
L143: "test:senpi": "bun run build:senpi-plugin && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/...
L144: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184: i
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
4 Critical14 High9 Medium6 Low
CriticalSame File Env Network Executiondist/skills/browser/runtime/omowright/index.js
CriticalDownload Executedist/skills/browser/runtime/omowright/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalAi Agent Control Hijackpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli-node/index.js
HighSandbox Evasion Gated Capabilitydist/skills/browser/runtime/omowright/index.js
Affected versions and remediation
This report applies to oh-my-opencode@5.0.0.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.