registry / oh-my-opencode / 5.1.57
oh-my-opencode@5.1.57
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged credential and endpoint patterns resolve to credential filtering and an authenticated, explicitly configured provider, not automatic forwarding of unrelated credentials. The install hook performs package-specific cache invalidation and binary checks; the CLI discloses anonymous telemetry and provides an opt-out.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installation runs the postinstall check; provider configuration requires OpenGateway authentication; telemetry runs with the CLI and is disclosed with an opt-out.
Impact
No malicious impact identified.
Mechanism
The install hook checks the local OpenCode version and platform binary and invalidates this package’s cached plugin entries. The skill MCP environment cleaner excludes recognized credential variables. OpenGateway uses its own credential; telemetry is disclosed as anonymous.
AI rationale
The flagged credential and endpoint patterns resolve to credential filtering and an authenticated, explicitly configured provider, not automatic forwarding of unrelated credentials. The install hook performs package-specific cache invalidation and binary checks; the CLI discloses anonymous telemetry and provides an opt-out.
Network endpoints2
apis.opengateway.ai/v1us.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest’s install hook runs postinstall.mjs; its prepare hook runs the build.
- The postinstall cache cleanup targets entries for this package in OpenCode’s cache.
- The skill MCP environment cleaner excludes known credentials, including Anthropic, AWS, Google, GitHub, and OpenAI keys.
- OpenGateway provider configuration is applied only when its own API key or provider authentication is present.
- The CLI discloses anonymous usage telemetry, says it excludes prompts, code, file paths, and account data, and provides an opt-out.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
GitDependency
Source & flagged code
22 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L63: "docs/reference/web-terminal-visual-qa.md",
L64: ".opencode/command",
L65: ".opencode/skills",
L66: ".agents/command",
L67: ".agents/skills",
L68: "packages/lsp-tools-mcp/package.json",
...
L98: "packages/prompts-core/prompts/ultrawork/codex.md",
L99: "packages/omo-codex/plugin/.codex-plugin",
L100: "!packages/omo-codex/plugin/node_modules",
...
L153: "test:fast": "bun run script/test-fast.ts",
L154: "test:senpi": "bun run build:senpi-plugin && bun check --no-script --all -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/sk...
L155: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184:
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
3 Critical13 High9 Medium7 Low
CriticalDownload Executepackages/omo-codex/plugin/components/lsp/dist/cli.js
CriticalEncrypted Payload Temp Executiondist/cli-node/index.js
CriticalAi Agent Control Hijackpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighSame File Env Network Executiondist/cli-node/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli-node/index.js
HighSandbox Evasion Gated Capabilitydist/skills/browser/runtime/omowright/index.js
Affected versions and remediation
This report applies to oh-my-opencode@5.1.57.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.57 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.