registry / AI-agent control-surface risk / opencode-skill-finder

opencode-skill-finder

OpenCode plugin that watches your task context, searches 7 skill marketplaces, caches locally with FTS5, and auto-recommends relevant skills.

This report shows the evidence for opencode-skill-finder@2.0.0, the only known version.

AI Security Review

scanned 4mo ago · by lpm-firewall-ai

Static inspection confirms unconsented postinstall mutation of OpenCode global config and AGENTS.md, which meets the firewall block policy for AI-agent control-surface writes. Other risky primitives are mostly package-aligned, but the install-time agent mutation is concrete enough to block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of opencode-skill-finder@2.0.0

Impact

Automatic activation/instruction injection in a broad AI-agent environment, giving the package persistent influence over future OpenCode sessions.

Mechanism

unconsented postinstall AI-agent config and instruction mutation

Policy narrative

On npm install, the postinstall script creates or edits the user's global OpenCode config, adds skill-finder to the plugin list, creates/appends AGENTS.md instructions, and copies the package dist into the OpenCode plugins directory. This is not just package-owned local setup; it changes a foreign AI-agent control surface at install time and can affect later agent behavior.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/index.jsdist/registry/adapters/agentskillsh-adapter.js~/.config/opencode/opencode.json~/.config/opencode/AGENTS.md~/.config/opencode/plugins/skill-finder/dist

Network endpoints6

agentskill.sh/api/skillsskills.sh/api/v1/skills/search/api/v1/skills/search

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 93.0% confidence with low false-positive risk.

Evidence for policy risk

package.json defines postinstall: node ./scripts/postinstall.mjs
scripts/postinstall.mjs writes ~/.config/opencode/opencode.json during npm install
scripts/postinstall.mjs appends/creates ~/.config/opencode/AGENTS.md with package instructions
scripts/postinstall.mjs copies package dist into ~/.config/opencode/plugins/skill-finder
dist/registry/adapters/agentskillsh-adapter.js can run npx @agentskill.sh/cli@latest setup on explicit install tool use

Evidence against

No credential harvesting or environment secret enumeration found
No install-time network fetch or remote payload execution in scripts/postinstall.mjs
Runtime fetch endpoints are skill marketplace APIs aligned with package purpose
Child_process use appears limited to user-invoked skill installation adapters

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

Source & flagged code

7 flagged

package.jsonView file

Lines 1-37json

2 "name": "opencode-skill-finder",

3 "version": "2.0.0",

4 "description": "OpenCode plugin that watches your task context, searches 7 skill marketplaces, caches locally with FTS5, and auto-recommends relevant skills.",

5 "type": "module",

6 "main": "./dist/index.js",

7 "exports": {

8 ".": "./dist/index.js"

9 },

10 "bin": {

11 "skill-finder": "./scripts/postinstall.mjs"

12 },

13 "scripts": {

14 "build": "tsc",

15 "test": "vitest run",

16 "typecheck": "tsc --noEmit",

17 "postinstall": "node ./scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "postupdate": "node ./scripts/postinstall.mjs"

19 },

20 "keywords": [

21 "opencode",

22 "plugin",

23 "skills",

24 "marketplace"

25 ],

26 "license": "MIT",

27 "author": "",

28 "repository": {

29 "type": "git",

30 "url": "https://github.com/brain-orch/skill-finder"

31 },

32 "dependencies": {

33 "@opencode-ai/plugin": "^1.17.0"

34 },

35 "devDependencies": {

36 "@types/better-sqlite3": "^7.6.13",

37 "@types/node": "^22.0.0",

dist/registry/adapters/agentskillsh-adapter.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import * as fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/registry/adapters/agentskillsh-adapter.jsView on unpkg · L1

3import *

dist/validation/security-auditor.test.jsView file

Lines 37-77javascript

37 });

38 it("should detect base64 payloads", () => {

39 const skill = { ...baseSkill, description: "Contains AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==" };

40 const result

scripts/postinstall.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync } from 'node:fs';

4import { join, dirname } from 'node:path';

5import { homedir } from 'node:os';

6import

install.shView file

•path = install.sh kind = build_helper sizeBytes = 8814 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/registry/adapters/agentskillsh-adapter.jsView file

1import { execSync } from "node:child_process"; L2: import * as fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/registry/adapters/agentskillsh-adapter.jsView on unpkg · L1

Findings

1 Critical4 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/registry/adapters/agentskillsh-adapter.js

HighShell

HighRuntime Package Installdist/registry/adapters/agentskillsh-adapter.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/validation/security-auditor.test.js

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to opencode-skill-finder@2.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing opencode-skill-finder@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-09 07:02:19.910Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

2.0.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 9, 2026, 3:43 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code