Loading npm security reports…

opencode-agent-skill@11.0.0: AI-agent control-surface risk | LPM Firewall

registry / opencode-agent-skill / 11.0.0

opencode-agent-skill@11.0.0

Perception-aware evidence-first engineering runtime with adaptive context, capability routing, visual/browser verification, weak-model recovery and benchmark-gated execution for OpenCode

AI Security Review

scanned 17d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An npm postinstall hook automatically alters the global OpenCode configuration during global installation. It installs agent resources and rewrites the managed section of global AGENTS.md.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Installing the package globally with npm.

Impact

Future OpenCode sessions can be influenced by package-provided global agents, skills, commands, plugins, and instructions without a separate setup command.

Mechanism

scripts/install.mjs invokes installResources, which creates OpenCode resource directories, installs a router plugin, and writes a package-provided instruction block to AGENTS.md.

Policy narrative

The package uses an automatic postinstall hook, rather than an explicit user command, to modify a broad AI-agent control surface on global installation. The lifecycle path installs package-controlled resources into the global OpenCode configuration and rewrites global AGENTS.md with package content. This persists agent behavior across later OpenCode sessions.

AI rationale

The automatic lifecycle hook performs broad global AI-agent configuration mutation, including AGENTS.md, plugins, agents, commands, and skills. This is concrete unconsented control-surface modification despite the absence of observed network exfiltration.

Evidence

package.jsonscripts/install.mjslib/installer.mjs

Decision evidence

public snapshot

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

evals/long/graders/long-horizon.mjsView file

13const load = async (file) => L14: import(pathToFileURL(path.join(workspace, "src", file)).href + "?eval=" + Date.now() + "-" + Math.random()) L15:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

evals/long/graders/long-horizon.mjsView on unpkg · L13

scripts/install.mjsView file

39Install-time code directly mutates a foreign AI-agent control surface: L51: console.log(`[ocskill] Commands: ${result.commands.length}`) L52: console.log(`[ocskill] Subagents: ${result.agents.length}`) L53: for (const warning of result.warnings) { Write operation from lib/installer.mjs: L39: export function getConfigDir() { L40: return process.env.OPENCODE_CONFIG_DIR L41: ? path.resolve(process.env.OPENCODE_CONFIG_DIR) L42: : path.join(os.homedir(), ".config", "opencode") ... L89: L90: await mkdir(path.dirname(file), { recursive: true }) L91: await writeFile(file, content, "utf8") ... L114: commands: Array.isArray(parsed.commands) ? parsed.commands.filter(validManagedMarkdown) : [], L115: agents: Array.isArray(parsed.agents) ? parsed.agents.filter(validManagedMarkdown) : [], L116: plugins

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.mjsView on unpkg · L39

evals/polyglot/fixtures/polyglot-bench/python/tenant_auth.pyView file

•path = [redacted]-bench/python/tenant_auth.py kind = payload_in_excluded_dir sizeBytes = 123 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

evals/polyglot/fixtures/polyglot-bench/python/tenant_auth.pyView on unpkg

•path = [redacted]-bench/python/tenant_auth.py kind = build_helper sizeBytes = 123 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

evals/polyglot/fixtures/polyglot-bench/python/tenant_auth.pyView on unpkg

lib/control-center.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/control-center.mjs#virtual:normalized:round1View on unpkg

global-config/plugins/ues-router/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = opencode-agent-skill@7.7.0 matchedIdentity = npm:b3BlbmNvZGUtYWdlbnQtc2tpbGw:7.7.0 similarity = 0.733 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

global-config/plugins/ues-router/index.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 7-47json

7 "ocskill": "bin/ocskill.mjs"

8 },

9 "files": [

10 "bin/ocskill.mjs",

11 "lib/",

12 "scripts/",

13 "global-config/",

14 "evals/",

15 "docs/",

16 "README.md",

17 "CHANGELOG.md",

18 "LICENSE"

19 ],

20 "scripts": {

21 "syntax": "node scripts/syntax-check.mjs",

22 "validate": "node scripts/validate.mjs",

23 "evals": "node scripts/eval-skills.mjs",

24 "evals:live:validate": "node scripts/validate-live-suite.mjs",

25 "test": "node --test test/*.test.mjs",

26 "ci": "npm run syntax && npm run validate && npm run evals && npm run evals:router && npm run evals:v11:validate && npm run evals:live:validate && npm run evals:long:validate && npm run evals:polyglot:validate && npm test && npm pack --dry-run && npm run smoke:pack && npm run smoke:plain-install",

27 "postinstall": "node scripts/install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "preuninstall": "node scripts/uninstall.mjs",

29 "prepublishOnly": "npm run ci",

30 "evals:live": "node scripts/eval-live.mjs",

31 "smoke:pack": "node scripts/smoke-packed-install.mjs",

32 "inspect:stack": "node scripts/detect-stack.mjs",

33 "inspect:tests": "node scripts/detect-test-commands.mjs",

34 "inspect:repo": "node scripts/repo-map.mjs",

35 "inspect:impact": "node scripts/impact-map.mjs",

36 "inspect:evidence": "node scripts/collect-evidence.mjs",

37 "inspect:git": "node scripts/check-working-tree.mjs",

38 "evals:report": "node scripts/eval-report.mjs",

39 "evals:router": "node scripts/eval-router.mjs",

40 "evals:long:validate": "node scripts/validate-live-suite.mjs --suite long",

41 "evals:long": "node scripts/eval-live.mjs --suite long",

42 "dashboard": "node scripts/control-center.mjs",

43 "evals:matrix": "node scripts/eval-matrix.mjs",

44 "smoke:plain-install": "node scripts/smoke-plain-install.mjs",

45 "release:check-tag": "node scripts/check-release-tag.mjs",

46 "evals:polyglot:validate": "node scripts/validate-live-suite.mjs --suite polyglot",

47 "evals:polyglot": "node scripts/eval-live.mjs --suite polyglot",

evals/long/graders/long-horizon.mjsView file

Lines 1-33javascript

1import assert from "node:assert/strict"

2import path from "node:path"

3import { spawnSync } from "node:child_process"

4import { fileURLToPath, pathToFileURL } from "node:url"

5

6

scripts/install.mjsView file

Lines 19-59javascript

19 return result.status === 0 ? result.stdout?.trim() : null

20}

21

22function isGlobalInstall() {

23 if (process.env.npm_config_global ===

evals/polyglot/fixtures/polyglot-bench/python/tenant_auth.pyView file

•path = [redacted]-bench/python/tenant_auth.py kind = payload_in_excluded_dir sizeBytes = 123 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

evals/polyglot/fixtures/polyglot-bench/python/tenant_auth.pyView on unpkg

•path = [redacted]-bench/python/tenant_auth.py kind = build_helper sizeBytes = 123 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

evals/polyglot/fixtures/polyglot-bench/python/tenant_auth.pyView on unpkg

lib/control-center.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/control-center.mjs#virtual:normalized:round1View on unpkg

global-config/plugins/ues-router/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = opencode-agent-skill@7.7.0 matchedIdentity = npm:b3BlbmNvZGUtYWdlbnQtc2tpbGw:7.7.0 similarity = 0.733 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

global-config/plugins/ues-router/index.jsView on unpkg