oh-my-opencode@5.1.18
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source supports a concrete warning for explicit agent configuration changes that weaken permission safeguards. It does not support the scanner's malicious verdict or an unconsented install-time agent takeover.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Run the CLI install or setup command and select Codex without disabling autonomous permissions.
Impact
Later Codex sessions can execute agent actions with fewer permission safeguards.
Mechanism
The installer writes Codex configuration with trusted hooks, agent entries, approval disabled, full filesystem access, and suppressed warnings.
AI rationale
Inspected source supports a concrete warning for explicit agent configuration changes that weaken permission safeguards. It does not support the scanner's malicious verdict or an unconsented install-time agent takeover.
Evidence
dist/cli-node/index.jsconfig.toml
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit CLI setup invokes the Codex installer when Codex is selected.
- Codex autonomous permissions default to enabled unless explicitly overridden.
- The installer targets config.toml under the selected Codex home and saves trusted hooks and agent configuration.
- Autonomous setup disables approval prompts, selects full filesystem access, and removes the root network restriction.
- Autonomous setup also hides full-access warnings and removes the Windows sandbox setting.
Evidence against
- The inspected postinstall verifies platform binaries and deletes only package-prefixed OpenCode cache directories; it does not invoke the Codex installer.
- The CLI exposes an option to leave existing Codex permissions unchanged.
- The flagged dynamic Function operation in dist/index.js compiles generated schema validation code; the inspected excerpt does not establish remote payload execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEval
Source & flagged code
23 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L62: "docs/reference/web-terminal-visual-qa.md",
L63: ".opencode/command",
L64: ".opencode/skills",
L65: ".agents/command",
L66: ".agents/skills",
L67: "packages/lsp-tools-mcp/package.json",
...
L97: "packages/prompts-core/prompts/ultrawork/codex.md",
L98: "packages/omo-codex/plugin/.codex-plugin",
L99: "!packages/omo-codex/plugin/node_modules",
...
L147: "test:fast": "bun run script/test-fast.ts",
L148: "test:senpi": "bun run build:senpi-plugin && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/...
L149: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184: i
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
4 Critical14 High9 Medium6 Low
CriticalSame File Env Network Executiondist/skills/browser/runtime/omowright/index.js
CriticalDownload Executedist/skills/browser/runtime/omowright/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalAi Agent Control Hijackpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli-node/index.js
HighSandbox Evasion Gated Capabilitydist/skills/browser/runtime/omowright/index.js
Affected versions and remediation
This report applies to oh-my-opencode@5.1.18.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.