registry / oh-my-opencode / 5.1.51
oh-my-opencode@5.1.51
⚠ Under reviewThe Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe inspected lifecycle, telemetry, research, and browser code did not establish malicious behavior. The package's CLI executes a platform-specific optional dependency whose source was unavailable, so the runtime behavior remains unresolved.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Running the package's CLI.
Impact
The binary's behavior and effects could not be determined from the available source.
Mechanism
The wrapper selects a platform-specific optional dependency and launches its binary with the caller's arguments.
AI rationale
The inspected lifecycle, telemetry, research, and browser code did not establish malicious behavior. The package's CLI executes a platform-specific optional dependency whose source was unavailable, so the runtime behavior remains unresolved.
Evidence
package.jsonbin/oh-my-opencode.js
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares same-version platform packages as optional dependencies, and the CLI wrapper selects and launches a matching package binary; that binary's source was unavailable for this review.
- The postinstall hook removes only matching OpenCode plugin cache directories and checks for a platform binary.
- Telemetry is package-branded, sends a daily-active event with system metadata, and has environment and configuration gates.
- The research command requires caller-provided arguments and a working directory, then runs without a shell.
- The browser helper obtains cookies for the requested URL and uses them in a fetch to that URL.
Evidence against
- The inspected package source did not establish malicious behavior; the unresolved concern is the executed platform binary, whose source was not available.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
23 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L62: "docs/reference/web-terminal-visual-qa.md",
L63: ".opencode/command",
L64: ".opencode/skills",
L65: ".agents/command",
L66: ".agents/skills",
L67: "packages/lsp-tools-mcp/package.json",
...
L97: "packages/prompts-core/prompts/ultrawork/codex.md",
L98: "packages/omo-codex/plugin/.codex-plugin",
L99: "!packages/omo-codex/plugin/node_modules",
...
L151: "test:fast": "bun run script/test-fast.ts",
L152: "test:senpi": "bun run build:senpi-plugin && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/...
L153: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184: i
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
5 Critical13 High9 Medium6 Low
CriticalSame File Env Network Executiondist/skills/browser/runtime/omowright/index.js
CriticalDownload Executedist/skills/browser/runtime/omowright/index.js
CriticalEncrypted Payload Temp Executiondist/cli-node/index.js
CriticalAi Agent Control Hijackpackage.json
CriticalPrevious Version Dangerous Deltadist/skills/ulw-research/scripts/source-commands.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltration
Affected versions and remediation
This report applies to oh-my-opencode@5.1.51.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.51 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.