registry / oh-my-opencode / 5.1.56
oh-my-opencode@5.1.56
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged credential match is in code that removes provider secrets from MCP child environments, and the gateway provider is configured only with its own explicit key. The lifecycle hook performs package-cache maintenance and a version check; the reviewed download-and-run lead is only error-message text.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installation runs the postinstall hook; other reviewed behavior is triggered by configured provider credentials or explicit CLI use.
Impact
No unauthorized credential transfer, remote code execution, or agent control mutation was identified in the reviewed paths.
Mechanism
The hook checks for a platform binary and invalidates matching OpenCode plugin cache entries. MCP launch environments filter credential variables; the OpenGateway provider uses its named key and endpoint. The curl command is displayed as troubleshooting text only.
AI rationale
The flagged credential match is in code that removes provider secrets from MCP child environments, and the gateway provider is configured only with its own explicit key. The lifecycle hook performs package-cache maintenance and a version check; the reviewed download-and-run lead is only error-message text.
Evidence
${XDG_CACHE_HOME:-~/.cache}/opencode
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The install hook checks the installed platform binary and clears only cached OpenCode plugin entries whose names start with this package’s names.
- MCP child environments explicitly exclude Anthropic, AWS, Google, GitHub, OpenAI, and other credential variables.
- The OpenGateway provider uses its own OPENGATEWAY_API_KEY and is configured only when that credential is present.
- The CLI telemetry disclosure provides a privacy-policy link and DO_NOT_TRACK=1 / OMO_DISABLE_TELEMETRY=1 opt-outs.
- The bun.sh curl text appears in an error message suggesting a manual install; it is not a download-and-execute action.
Evidence against
- The package has a postinstall lifecycle hook that probes the OpenCode version and invalidates its plugin cache.
- The bundled CLI includes telemetry code and a PostHog endpoint.
- Scanner findings point to code execution, credential redirection, and agent control, but the reviewed excerpts do not substantiate those behaviors.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
22 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L63: "docs/reference/web-terminal-visual-qa.md",
L64: ".opencode/command",
L65: ".opencode/skills",
L66: ".agents/command",
L67: ".agents/skills",
L68: "packages/lsp-tools-mcp/package.json",
...
L98: "packages/prompts-core/prompts/ultrawork/codex.md",
L99: "packages/omo-codex/plugin/.codex-plugin",
L100: "!packages/omo-codex/plugin/node_modules",
...
L153: "test:fast": "bun run script/test-fast.ts",
L154: "test:senpi": "bun run build:senpi-plugin && bun check --no-script --all -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/sk...
L155: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184:
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
3 Critical13 High9 Medium7 Low
CriticalDownload Executepackages/omo-codex/plugin/components/lsp/dist/cli.js
CriticalEncrypted Payload Temp Executiondist/cli-node/index.js
CriticalAi Agent Control Hijackpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighSame File Env Network Executiondist/cli-node/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli-node/index.js
HighSandbox Evasion Gated Capabilitydist/skills/browser/runtime/omowright/index.js
Affected versions and remediation
This report applies to oh-my-opencode@5.1.56.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.56 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.