registry / oh-my-opencode / 5.1.55
oh-my-opencode@5.1.55
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged credential-to-host matches resolve to optional provider configuration and model catalog entries, while the install hook performs local version checks and plugin cache maintenance. I found no concrete malicious behavior in the inspected paths.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Postinstall runs after installation for local compatibility checks and cache maintenance; provider access depends on the user configuring that provider.
Impact
No malicious data collection, credential redirection, or unrelated remote execution was identified in the inspected paths.
Mechanism
The inspected provider setup checks for its own API key, and the flagged alternate host appears in model metadata. The install hook operates on matching plugin cache directories.
AI rationale
The flagged credential-to-host matches resolve to optional provider configuration and model catalog entries, while the install hook performs local version checks and plugin cache maintenance. I found no concrete malicious behavior in the inspected paths.
Evidence
$XDG_CACHE_HOME/opencode~/.cache/opencode
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exports the plugin entry point and declares postinstall as a local script.
- Postinstall checks the OpenCode version and platform binary, then removes cache directories matching this plugin’s package names.
- OpenGateway configuration uses the specifically named OPENGATEWAY_API_KEY and its own service URL.
- The MCP environment cleaner excludes common API keys, cloud credentials, tokens, and passwords.
- The api.ant-ling.com match is a model catalog entry for the Ling provider.
Evidence against
- Postinstall recursively removes matching OpenCode plugin cache directories, which is an automatic local file change.
- The package includes subprocess and network capabilities consistent with a CLI and AI agent plugin.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
23 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L63: "docs/reference/web-terminal-visual-qa.md",
L64: ".opencode/command",
L65: ".opencode/skills",
L66: ".agents/command",
L67: ".agents/skills",
L68: "packages/lsp-tools-mcp/package.json",
...
L98: "packages/prompts-core/prompts/ultrawork/codex.md",
L99: "packages/omo-codex/plugin/.codex-plugin",
L100: "!packages/omo-codex/plugin/node_modules",
...
L153: "test:fast": "bun run script/test-fast.ts",
L154: "test:senpi": "bun run build:senpi-plugin && bun check --no-script --all -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/sk...
L155: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184:
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
4 Critical13 High9 Medium7 Low
CriticalDownload Executepackages/omo-codex/plugin/components/lsp/dist/cli.js
CriticalEncrypted Payload Temp Executiondist/cli-node/index.js
CriticalAi Agent Control Hijackpackage.json
CriticalPrevious Version Dangerous Deltadist/skills/programming/scripts/typescript/check-test-junk.test.ts
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighSame File Env Network Executiondist/cli-node/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltration
Affected versions and remediation
This report applies to oh-my-opencode@5.1.55.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.55 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.