oh-my-opencode@5.1.59
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe bundled CLI sends runtime activity telemetry by default, and the inspected package documentation does not clearly disclose that behavior. The event contains ordinary machine and product metadata rather than credentials or project content, so this warrants a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user starts a run with the bundled CLI while telemetry is not disabled.
Impact
This collects activity and environment metadata without a clear disclosure of the default runtime telemetry behavior in the inspected package documentation.
Mechanism
The CLI tracks a daily `run_started` event using an install ID and product, runtime, platform, and machine properties; opt-out settings can disable it.
AI rationale
The bundled CLI sends runtime activity telemetry by default, and the inspected package documentation does not clearly disclose that behavior. The event contains ordinary machine and product metadata rather than credentials or project content, so this warrants a warning rather than a publish block.
Evidence
dist/cli-node/index.js
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The bundled CLI tracks a `run_started` event when its run command starts.
- Telemetry is enabled unless disabled by configuration or an opt-out environment variable; absent those, the opt-out check does not disable it.
- The event includes a persistent install ID and daily activity reason, along with package, runtime, platform, and machine details.
- The bundled telemetry client uses `https://us.i.posthog.com` by default.
Evidence against
- The inspected telemetry fields are ordinary product and machine-use metadata; no credentials, prompts, or project files appear in the event payload.
- The install hook checks the local OpenCode version and platform binary and invalidates this package's OpenCode cache; no install-time network transmission was identified.
- The manifest routes the package entry to its bundled code and defines a postinstall hook, but the hook's inspected behavior did not show the flagged credential redirection.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
22 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L63: "docs/reference/web-terminal-visual-qa.md",
L64: ".opencode/command",
L65: ".opencode/skills",
L66: ".agents/command",
L67: ".agents/skills",
L68: "packages/lsp-tools-mcp/package.json",
...
L98: "packages/prompts-core/prompts/ultrawork/codex.md",
L99: "packages/omo-codex/plugin/.codex-plugin",
L100: "!packages/omo-codex/plugin/node_modules",
...
L153: "test:fast": "bun run script/test-fast.ts",
L154: "test:senpi": "bun run build:senpi-plugin && bun check --no-script --all -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/sk...
L155: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184:
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
3 Critical13 High9 Medium7 Low
CriticalDownload Executepackages/omo-codex/plugin/components/lsp/dist/cli.js
CriticalEncrypted Payload Temp Executiondist/cli-node/index.js
CriticalAi Agent Control Hijackpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighSame File Env Network Executiondist/cli-node/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli-node/index.js
HighSandbox Evasion Gated Capabilitydist/skills/browser/runtime/omowright/index.js
Affected versions and remediation
This report applies to oh-my-opencode@5.1.59.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.59 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.