registry / opencode-onboard / 1.2.0

opencode-onboard@1.2.0

Prepare any codebase for AI. Wires OpenCode, OpenSpec, codegraph, and basic-memory into a multi-agent development workflow powered by native parallel subagents.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

FilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 94.0 KB of source, external domains: docs.astral.sh, github.com, models.dev, opencode.ai

Source & flagged code

2 flagged

src/utils/exec.jsView file

Lines 1-21javascript

1import chalk from 'chalk'

2import { execa } from 'execa'

3import ora from 'ora'

High

Shell

Package source references shell execution.

src/utils/exec.jsView on unpkg · L1

4import { appendLine, redraw, rotateStep, startSpinner, stopSpinner } from './exec-spinner.js'

5import { MARKERS } from './terminal.js';

7// ── Public API ───────────────────────────────────────────────────────────────

9/**

10 * Run a shell command with a spinner.

11 * Returns { success, stdout, stderr }

12 */

13export async function run(command, args = [], { label, cwd = process.cwd() } = {}) {

14 const spinner = ora(label ?? `${command} ${args.join(' ')}`).start();

15 try {

16 const result = await execa(command, args, { cwd, reject: false });

17 if (result.exitCode === 0) {

18 spinner.succeed();

19 } else {

20 spinner.fail();

21 }

src/steps/optimization/caveman.jsView file

Lines 1-21javascript

1import { execa } from 'execa'

2import { header, success, warn, error, loading, info } from '../../utils/exec.js'

4export async function installCaveman(options = {}) {

5 if (!options.skipHeader) header('Installing caveman')

Source & flagged code

2 flagged · loading source

src/utils/exec.jsView file

1import chalk from 'chalk' L2: import { execa } from 'execa' L3: import ora from 'ora'

High

Shell

Package source references shell execution.

src/utils/exec.jsView on unpkg · L1

src/steps/optimization/caveman.jsView file

1import { execa } from 'execa' L2: import { header, success, warn, error, loading, info } from '../../utils/exec.js' ... L14: try { L15: info('Installing caveman via npx skills') L16: const result = await execa('npx', skillsArgs, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/steps/optimization/caveman.jsView on unpkg · L1

Findings

2 High2 Medium4 Low

HighShellsrc/utils/exec.js

HighRuntime Package Installsrc/steps/optimization/caveman.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/utils/exec.jsView file

Lines 1-21javascript

1import chalk from 'chalk'

2import { execa } from 'execa'

3import ora from 'ora'

High

Shell

Package source references shell execution.

src/utils/exec.jsView on unpkg · L1

4import { appendLine, redraw, rotateStep, startSpinner, stopSpinner } from './exec-spinner.js'

5import { MARKERS } from './terminal.js';

9/**

10 * Run a shell command with a spinner.

11 * Returns { success, stdout, stderr }

12 */

13export async function run(command, args = [], { label, cwd = process.cwd() } = {}) {

14 const spinner = ora(label ?? `${command} ${args.join(' ')}`).start();

15 try {

16 const result = await execa(command, args, { cwd, reject: false });

17 if (result.exitCode === 0) {

18 spinner.succeed();

19 } else {

20 spinner.fail();

21 }

src/steps/optimization/caveman.jsView file

Lines 1-21javascript

1import { execa } from 'execa'

2import { header, success, warn, error, loading, info } from '../../utils/exec.js'

4export async function installCaveman(options = {}) {

5 if (!options.skipHeader) header('Installing caveman')