registry / oh-my-opencode / 5.1.54
oh-my-opencode@5.1.54
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe scanner’s credential and foreign-host signals resolve to provider-specific configuration and model catalog URLs; the inspected source does not show credentials being redirected or collected for an unrelated purpose. The postinstall hook checks the platform binary and clears cache entries for this plugin.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Provider requests occur when the corresponding provider is configured and used; postinstall runs during installation.
Impact
No unauthorized credential transfer, unrelated collection, or harmful install-time behavior was identified.
Mechanism
The provider uses its own named API key and service URL. The install hook checks binary availability and invalidates this plugin’s OpenCode cache entries.
AI rationale
The scanner’s credential and foreign-host signals resolve to provider-specific configuration and model catalog URLs; the inspected source does not show credentials being redirected or collected for an unrelated purpose. The postinstall hook checks the platform binary and clears cache entries for this plugin.
Evidence
OpenCode plugin cache entries matching oh-my-opencode@ or oh-my-openagent@
Network endpoints2
apis.opengateway.aiapi.ant-ling.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points the package entry to dist/index.js and defines its CLI separately.
- The OpenGateway provider uses its named OPENGATEWAY_API_KEY and the documented OpenGateway API base URL.
- The provider configuration is applied only when that provider has a credential.
- The install hook checks the platform binary and invalidates cache entries for this package’s OpenCode plugin.
- The Ant Ling URL appears in a model catalog entry as that provider’s base URL.
Evidence against
- The package has a postinstall hook and bundled code that accesses credentials and network endpoints; review found no evidence these send unrelated credentials or data.
- The scanner’s alleged foreign-host credential flow is consistent with provider catalog entries and provider-specific configuration in the inspected source.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
23 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L62: "docs/reference/web-terminal-visual-qa.md",
L63: ".opencode/command",
L64: ".opencode/skills",
L65: ".agents/command",
L66: ".agents/skills",
L67: "packages/lsp-tools-mcp/package.json",
...
L97: "packages/prompts-core/prompts/ultrawork/codex.md",
L98: "packages/omo-codex/plugin/.codex-plugin",
L99: "!packages/omo-codex/plugin/node_modules",
...
L152: "test:fast": "bun run script/test-fast.ts",
L153: "test:senpi": "bun run build:senpi-plugin && bun check --no-script --all -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/sk...
L154: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184: i
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
4 Critical13 High9 Medium7 Low
CriticalDownload Executepackages/omo-codex/plugin/components/lsp/dist/cli.js
CriticalEncrypted Payload Temp Executiondist/cli-node/index.js
CriticalAi Agent Control Hijackpackage.json
CriticalPrevious Version Dangerous Deltadist/skills/programming/scripts/scaffolders.test.ts
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighSame File Env Network Executiondist/cli-node/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltration
Affected versions and remediation
This report applies to oh-my-opencode@5.1.54.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.54 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.