registry / opencode-agent-kit / 1.3.11

opencode-agent-kit@1.3.11

Multi-stack OpenCode agent toolkit — 33+ specialized AI agents, 200+ skills, 46 commands, 8 MCP servers (Nuxt, React, Node.js, Laravel, CI3, Android, Flutter, DevOps, SEO, SonarQube, and more)

Static Scan Results

scanned 19h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 69.8 KB of source, external domains: opencode.ai

Source & flagged code

13 flagged

bin/commands/upgrade.mjsView file

Lines 1-21javascript

1import { execSync } from 'child_process';

2import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

bin/commands/upgrade.mjsView on unpkg · L1

3const PKG_NAME = 'opencode-agent-kit';

5/**

6 * Get the currently installed version from package.json

7 */

8function getCurrentVersion() {

9 const pkgPath = new globalThis.URL('../../package.json', import.meta.url);

10 const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));

11 return pkg.version;

12}

14/**

15 * Get the latest available version from npm

16 */

17function getLatestVersion() {

18 try {

19 return execSync(`npm view ${PKG_NAME} version`, {

20 encoding: 'utf-8',

21 timeout: 10000,

Lines 34-66javascript

34 const current = getCurrentVersion();

35 console.log(` Current version: v${current}`);

37 console.log(` Checking npm registry...`);

38 const latest = getLatestVersion();

40 if (!

bin/commands/migrate.mjsView file

Lines 130-170javascript

130

131 console.log(` ${C.dim}${'─'.repeat(50)}${C.reset}`);

132 info(

133 `Found ${pending.length} pending migration(s) — v${installedVersion || '0.0.0'} → v${

template/.opencode/skills/shadcn-ui/scripts/verify-setup.shView file

•path = template/.opencode/skills/shadcn-ui/scripts/verify-setup.sh kind = payload_in_excluded_dir sizeBytes = 4409 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.opencode/skills/shadcn-ui/scripts/verify-setup.shView on unpkg

•path = template/.opencode/skills/shadcn-ui/scripts/verify-setup.sh kind = build_helper sizeBytes = 4409 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.opencode/skills/shadcn-ui/scripts/verify-setup.shView on unpkg

template/.opencode/skills/frontend-a11y/SKILL.mdView file

Lines 72-112markdown

72 </span>

73)}

74```

76### Complete Accessible Form

78```tsx

79interface LoginFormProps {

80 onSubmit: (email: string, password: string) => void;

81}

83export function LoginForm({ onSubmit }: LoginFormProps) {

84 const [email, setEmail] = useState('');

template/.opencode/skills/laravel-service-repository/SKILL.mdView file

Lines 582-622markdown

582// Usage

583$product->formatted_price; // "Rp 150.000"

584```

585

586**Mutator (setter)**

587```php

588class User extends Model

589{

590 public function setPasswordAttribute(string $value): void

591 {

592 $this->attributes['password'] = bcrypt($value);

593 }

template/.opencode/skills/node-express-prisma/SKILL.mdView file

Lines 704-779markdown

704

705export { prisma }

706```

707

708### Integration Test (`tests/user.test.ts`)

709

710```typescript

711import { describe, it, expect, beforeAll } from 'vitest'

712import supertest from 'supertest'

713import app from '../app'

714

715const request = supertest(app)

716

template/.opencode/skills/django-tdd/SKILL.mdView file

24patternName = generic_password severity = medium line = 24 matchedText = user = U...23')

Medium

Secret Pattern

Hardcoded password in template/.opencode/skills/django-tdd/SKILL.md

template/.opencode/skills/django-tdd/SKILL.mdView on unpkg · L24

116patternName = generic_password severity = medium line = 116 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in template/.opencode/skills/django-tdd/SKILL.md

template/.opencode/skills/django-tdd/SKILL.mdView on unpkg · L116

125patternName = generic_password severity = medium line = 125 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in template/.opencode/skills/django-tdd/SKILL.md

template/.opencode/skills/django-tdd/SKILL.mdView on unpkg · L125

Source & flagged code

13 flagged · loading source

bin/commands/upgrade.mjsView file

1import { execSync } from 'child_process'; L2: import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

bin/commands/upgrade.mjsView on unpkg · L1

54try { L55: execSync(`npm install -g ${PKG_NAME}@latest`, { L56: stdio: verbose ? 'inherit' : 'pipe',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/commands/upgrade.mjsView on unpkg · L54

bin/commands/migrate.mjsView file

150L151: const { default: migration } = await import(migrationPath); L152: const result = await migration.up({

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/commands/migrate.mjsView on unpkg · L150

template/.opencode/skills/shadcn-ui/scripts/verify-setup.shView file

•path = template/.opencode/skills/shadcn-ui/scripts/verify-setup.sh kind = payload_in_excluded_dir sizeBytes = 4409 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.opencode/skills/shadcn-ui/scripts/verify-setup.shView on unpkg

•path = template/.opencode/skills/shadcn-ui/scripts/verify-setup.sh kind = build_helper sizeBytes = 4409 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.opencode/skills/shadcn-ui/scripts/verify-setup.shView on unpkg

template/.opencode/skills/frontend-a11y/SKILL.mdView file

92patternName = generic_password severity = medium line = 92 matchedText = if (!pas...ed';

Medium

Secret Pattern

Hardcoded password in template/.opencode/skills/frontend-a11y/SKILL.md

template/.opencode/skills/frontend-a11y/SKILL.mdView on unpkg · L92

template/.opencode/skills/laravel-service-repository/SKILL.mdView file

602patternName = generic_password severity = medium line = 602 matchedText = $user->p...ator

Medium

Secret Pattern

Hardcoded password in template/.opencode/skills/laravel-service-repository/SKILL.md

template/.opencode/skills/laravel-service-repository/SKILL.mdView on unpkg · L602

template/.opencode/skills/node-express-prisma/SKILL.mdView file

724patternName = generic_password severity = medium line = 724 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in template/.opencode/skills/node-express-prisma/SKILL.md

template/.opencode/skills/node-express-prisma/SKILL.mdView on unpkg · L724

740patternName = generic_password severity = medium line = 740 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in template/.opencode/skills/node-express-prisma/SKILL.md

template/.opencode/skills/node-express-prisma/SKILL.mdView on unpkg · L740

759patternName = generic_password severity = medium line = 759 matchedText = .send({ ...' })

Medium

Secret Pattern

Hardcoded password in template/.opencode/skills/node-express-prisma/SKILL.md

template/.opencode/skills/node-express-prisma/SKILL.mdView on unpkg · L759

template/.opencode/skills/django-tdd/SKILL.mdView file

24patternName = generic_password severity = medium line = 24 matchedText = user = U...23')

Medium

Secret Pattern

Hardcoded password in template/.opencode/skills/django-tdd/SKILL.md

template/.opencode/skills/django-tdd/SKILL.mdView on unpkg · L24

116patternName = generic_password severity = medium line = 116 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in template/.opencode/skills/django-tdd/SKILL.md

template/.opencode/skills/django-tdd/SKILL.mdView on unpkg · L116

125patternName = generic_password severity = medium line = 125 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in template/.opencode/skills/django-tdd/SKILL.md

template/.opencode/skills/django-tdd/SKILL.mdView on unpkg · L125

Findings

4 High12 Medium5 Low

HighChild Processbin/commands/upgrade.mjs

HighShell

HighRuntime Package Installbin/commands/upgrade.mjs

HighPayload In Excluded Dirtemplate/.opencode/skills/shadcn-ui/scripts/verify-setup.sh

MediumDynamic Requirebin/commands/migrate.mjs

MediumEnvironment Vars

MediumShips Build Helpertemplate/.opencode/skills/shadcn-ui/scripts/verify-setup.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterntemplate/.opencode/skills/frontend-a11y/SKILL.md

MediumSecret Patterntemplate/.opencode/skills/laravel-service-repository/SKILL.md

MediumSecret Patterntemplate/.opencode/skills/node-express-prisma/SKILL.md

MediumSecret Patterntemplate/.opencode/skills/django-tdd/SKILL.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

13 flagged

bin/commands/upgrade.mjsView file

Lines 1-21javascript

1import { execSync } from 'child_process';

2import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

bin/commands/upgrade.mjsView on unpkg · L1

3const PKG_NAME = 'opencode-agent-kit';

5/**

6 * Get the currently installed version from package.json

7 */

8function getCurrentVersion() {

9 const pkgPath = new globalThis.URL('../../package.json', import.meta.url);

10 const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));

11 return pkg.version;

12}

14/**

15 * Get the latest available version from npm

16 */

17function getLatestVersion() {

18 try {

19 return execSync(`npm view ${PKG_NAME} version`, {

20 encoding: 'utf-8',

21 timeout: 10000,

Lines 34-66javascript

34 const current = getCurrentVersion();

35 console.log(` Current version: v${current}`);

37 console.log(` Checking npm registry...`);

38 const latest = getLatestVersion();

40 if (!

bin/commands/migrate.mjsView file

Lines 130-170javascript

130

131 console.log(` ${C.dim}${'─'.repeat(50)}${C.reset}`);

132 info(

133 `Found ${pending.length} pending migration(s) — v${installedVersion || '0.0.0'} → v${

template/.opencode/skills/shadcn-ui/scripts/verify-setup.shView file

•path = template/.opencode/skills/shadcn-ui/scripts/verify-setup.sh kind = payload_in_excluded_dir sizeBytes = 4409 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.opencode/skills/shadcn-ui/scripts/verify-setup.shView on unpkg

•path = template/.opencode/skills/shadcn-ui/scripts/verify-setup.sh kind = build_helper sizeBytes = 4409 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.opencode/skills/shadcn-ui/scripts/verify-setup.shView on unpkg

template/.opencode/skills/frontend-a11y/SKILL.mdView file

Lines 72-112markdown

72 </span>

73)}

74```

76### Complete Accessible Form

78```tsx

79interface LoginFormProps {

80 onSubmit: (email: string, password: string) => void;

81}

83export function LoginForm({ onSubmit }: LoginFormProps) {

84 const [email, setEmail] = useState('');

template/.opencode/skills/laravel-service-repository/SKILL.mdView file

Lines 582-622markdown

582// Usage

583$product->formatted_price; // "Rp 150.000"

584```

585

586**Mutator (setter)**

587```php

588class User extends Model

589{

590 public function setPasswordAttribute(string $value): void

591 {

592 $this->attributes['password'] = bcrypt($value);

593 }

template/.opencode/skills/node-express-prisma/SKILL.mdView file

Lines 704-779markdown

704

705export { prisma }

706```

707

708### Integration Test (`tests/user.test.ts`)

709

710```typescript

711import { describe, it, expect, beforeAll } from 'vitest'

712import supertest from 'supertest'

713import app from '../app'

714

715const request = supertest(app)

716

template/.opencode/skills/django-tdd/SKILL.mdView file

24patternName = generic_password severity = medium line = 24 matchedText = user = U...23')

Medium

Secret Pattern

Hardcoded password in template/.opencode/skills/django-tdd/SKILL.md

template/.opencode/skills/django-tdd/SKILL.mdView on unpkg · L24

116patternName = generic_password severity = medium line = 116 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in template/.opencode/skills/django-tdd/SKILL.md

template/.opencode/skills/django-tdd/SKILL.mdView on unpkg · L116

125patternName = generic_password severity = medium line = 125 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in template/.opencode/skills/django-tdd/SKILL.md

template/.opencode/skills/django-tdd/SKILL.mdView on unpkg · L125