oh-my-opencode@5.1.47
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource inspection found remote code execution in the bundled browser onboarding path, which installs the missing BrowserSkill CLI without a separate confirmation in that path. The package lifecycle hook is separate and does not perform this download, so the evidence supports a warning rather than a malicious package-install verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Calling bskOnboard when the BrowserSkill CLI is missing.
Impact
Code supplied by the remote installer executes on the user’s machine during onboarding.
Mechanism
The onboarding helper runs a shell or PowerShell command that downloads the installer from Tencent’s BrowserSkill repository and pipes it directly to the interpreter.
AI rationale
Source inspection found remote code execution in the bundled browser onboarding path, which installs the missing BrowserSkill CLI without a separate confirmation in that path. The package lifecycle hook is separate and does not perform this download, so the evidence supports a warning rather than a malicious package-install verdict.
Evidence
dist/skills/browser/runtime/omowright/index.js
Network endpoints2
raw.githubusercontent.com/Tencent/BrowserSkill/main/install.shraw.githubusercontent.com/Tencent/BrowserSkill/main/install.ps1
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The bundled browser onboarding helper builds a command that pipes an installer from Tencent’s BrowserSkill repository into a shell or PowerShell.
- When onboarding finds the helper CLI missing, it calls the installer automatically.
- The installer runs that command and checks for the installed binary.
- The npm postinstall hook is separate and checks for a platform binary package.
Evidence against
- The remote installer runs only through the browser onboarding path, not the package’s npm postinstall hook.
- The package postinstall code checks for an installed platform binary and reports a warning if it is missing.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
22 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L62: "docs/reference/web-terminal-visual-qa.md",
L63: ".opencode/command",
L64: ".opencode/skills",
L65: ".agents/command",
L66: ".agents/skills",
L67: "packages/lsp-tools-mcp/package.json",
...
L97: "packages/prompts-core/prompts/ultrawork/codex.md",
L98: "packages/omo-codex/plugin/.codex-plugin",
L99: "!packages/omo-codex/plugin/node_modules",
...
L150: "test:fast": "bun run script/test-fast.ts",
L151: "test:senpi": "bun run build:senpi-plugin && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/...
L152: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184: i
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
4 Critical13 High9 Medium6 Low
CriticalSame File Env Network Executiondist/skills/browser/runtime/omowright/index.js
CriticalDownload Executedist/skills/browser/runtime/omowright/index.js
CriticalEncrypted Payload Temp Executiondist/cli-node/index.js
CriticalAi Agent Control Hijackpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli-node/index.js
HighSandbox Evasion Gated Capabilitydist/skills/browser/runtime/omowright/index.js
Affected versions and remediation
This report applies to oh-my-opencode@5.1.47.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.47 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.