registry / opencode-skills-collection / 3.1.21

opencode-skills-collection@3.1.21

⚠ Under review

OpenCode CLI plugin that automatically downloads and keeps skills up to date.

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 50 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 168 file(s), 1.02 MB of source, external domains: amazon.com, api.apify.com, api.expo.dev, browserbase.com, console.apify.com, developers.notion.com, docs.anthropic.com, docs.stripe.com, fonts.googleapis.com, github.com, graph.facebook.com, huggingface.co, kit.svelte.dev, nextjs.org, platform.openai.com, prod.spline.design, turborepo.dev, vercel.com, web.dev, www.w3.org

Source & flagged code

39 flagged

bundled-skills/docs/maintainers/full-repo-audit-2026-05-23.mdView file

262patternName = aws_access_key severity = critical line = 262 matchedText = - Eviden...der.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bundled-skills/docs/maintainers/full-repo-audit-2026-05-23.mdView on unpkg · L262

262patternName = aws_access_key severity = critical line = 262 matchedText = - Eviden...der.

Critical

Secret Pattern

AWS access key ID in bundled-skills/docs/maintainers/full-repo-audit-2026-05-23.md

bundled-skills/docs/maintainers/full-repo-audit-2026-05-23.mdView on unpkg · L262

262patternName = private_key_rsa severity = critical line = 262 matchedText = - Eviden...der.

Critical

Secret Pattern

RSA private key in bundled-skills/docs/maintainers/full-repo-audit-2026-05-23.md

bundled-skills/docs/maintainers/full-repo-audit-2026-05-23.mdView on unpkg · L262

bundled-skills/playwright-skill/run.jsView file

14const path = require('path'); L15: const { execSync } = require('child_process'); L16: const sanitizeFilename = require('sanitize-filename');

High

Child Process

Package source references child process execution.

bundled-skills/playwright-skill/run.jsView on unpkg · L14

12L13: const fs = require('fs'); L14: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bundled-skills/playwright-skill/run.jsView on unpkg · L12

bundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsxView file

39L40: const token = process.env.HF_TOKEN; L41: const headers: Record<string, string> = token ... L44: L45: const url = `https://huggingface.co/api/models?limit=${limit}`; L46: ... L54: L55: const text = await res.text(); L56: process.stdout.write(text); L57: })();

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

bundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsxView on unpkg · L39

bundled-skills/vercel-optimize/lib/vercel.mjsView file

15try { L16: const { stdout } = await exec('vercel', ['--version']); L17: raw = stdout.trim(); ... L27: throw new Error( L28: `VERCEL_CLI_TOO_OLD: have ${v.join('.')}, need >= ${MIN_CLI_VERSION.join('.')}. Upgrade with \`npm i -g vercel@latest\`.` L29: );

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bundled-skills/vercel-optimize/lib/vercel.mjsView on unpkg · L15

bundled-skills/deploy-to-vercel/resources/deploy.shView file

•path = bundled-skills/deploy-to-vercel/resources/deploy.sh kind = build_helper sizeBytes = 8841 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bundled-skills/deploy-to-vercel/resources/deploy.shView on unpkg

bundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = bundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

bundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

bundled-skills/theme-factory/theme-showcase.pdfView file

•path = bundled-skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

bundled-skills/theme-factory/theme-showcase.pdfView on unpkg

bundled-skills/last30days/tests/test_dates.pyView file

•path = bundled-skills/last30days/tests/test_dates.py kind = payload_in_excluded_dir sizeBytes = 3684 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

bundled-skills/last30days/tests/test_dates.pyView on unpkg

bundled-skills/competitor-analysis/scripts/gate_candidates.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = opencode-sk[redacted]@3.1.15 matchedIdentity = npm:[redacted]:3.1.15 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bundled-skills/competitor-analysis/scripts/gate_candidates.mjsView on unpkg

bundled-skills/production-code-audit/SKILL.mdView file

152patternName = generic_password severity = medium line = 152 matchedText = - Before...23!'

Medium

Secret Pattern

Hardcoded password in bundled-skills/production-code-audit/SKILL.md

bundled-skills/production-code-audit/SKILL.mdView on unpkg · L152

bundled-skills/screenshots/SKILL.mdView file

187patternName = generic_password severity = medium line = 187 matchedText = password...D]',

Medium

Secret Pattern

Hardcoded password in bundled-skills/screenshots/SKILL.md

bundled-skills/screenshots/SKILL.mdView on unpkg · L187

bundled-skills/deployment-validation-config-validate/SKILL.mdView file

254patternName = generic_password severity = medium line = 254 matchedText = password...123'

Medium

Secret Pattern

Hardcoded password in bundled-skills/deployment-validation-config-validate/SKILL.md

bundled-skills/deployment-validation-config-validate/SKILL.mdView on unpkg · L254

267patternName = generic_password severity = medium line = 267 matchedText = password...123'

Medium

Secret Pattern

Hardcoded password in bundled-skills/deployment-validation-config-validate/SKILL.md

bundled-skills/deployment-validation-config-validate/SKILL.mdView on unpkg · L267

bundled-skills/fp-backend/SKILL.mdView file

1098patternName = generic_password severity = medium line = 1098 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in bundled-skills/fp-backend/SKILL.md

bundled-skills/fp-backend/SKILL.mdView on unpkg · L1098

1213patternName = generic_password severity = medium line = 1213 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in bundled-skills/fp-backend/SKILL.md

bundled-skills/fp-backend/SKILL.mdView on unpkg · L1213

bundled-skills/javascript-testing-patterns/resources/implementation-playbook.mdView file

516patternName = generic_password severity = medium line = 516 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in bundled-skills/javascript-testing-patterns/resources/implementation-playbook.md

bundled-skills/javascript-testing-patterns/resources/implementation-playbook.mdView on unpkg · L516

536patternName = generic_password severity = medium line = 536 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in bundled-skills/javascript-testing-patterns/resources/implementation-playbook.md

bundled-skills/javascript-testing-patterns/resources/implementation-playbook.mdView on unpkg · L536

551patternName = generic_password severity = medium line = 551 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in bundled-skills/javascript-testing-patterns/resources/implementation-playbook.md

bundled-skills/javascript-testing-patterns/resources/implementation-playbook.mdView on unpkg · L551

bundled-skills/fp-ts-errors/SKILL.mdView file

372patternName = generic_password severity = medium line = 372 matchedText = validate...5 })

Medium

Secret Pattern

Hardcoded password in bundled-skills/fp-ts-errors/SKILL.md

bundled-skills/fp-ts-errors/SKILL.mdView on unpkg · L372

373patternName = generic_password severity = medium line = 373 matchedText = // Right...5 })

Medium

Secret Pattern

Hardcoded password in bundled-skills/fp-ts-errors/SKILL.md

bundled-skills/fp-ts-errors/SKILL.mdView on unpkg · L373

bundled-skills/rclone-cli/references/providers/sftp.mdView file

157patternName = private_key_rsa severity = critical line = 157 matchedText = key_pem ...----

Critical

Secret Pattern

RSA private key in bundled-skills/rclone-cli/references/providers/sftp.md

bundled-skills/rclone-cli/references/providers/sftp.mdView on unpkg · L157

491patternName = private_key_rsa severity = critical line = 491 matchedText = key_pem ...----

Critical

Secret Pattern

RSA private key in bundled-skills/rclone-cli/references/providers/sftp.md

bundled-skills/rclone-cli/references/providers/sftp.mdView on unpkg · L491

bundled-skills/sql-injection-testing/SKILL.mdView file

215patternName = generic_password severity = medium line = 215 matchedText = SELECT *...ing'

Medium

Secret Pattern

Hardcoded password in bundled-skills/sql-injection-testing/SKILL.md

bundled-skills/sql-injection-testing/SKILL.mdView on unpkg · L215

418patternName = generic_password severity = medium line = 418 matchedText = SELECT *...ing'

Medium

Secret Pattern

Hardcoded password in bundled-skills/sql-injection-testing/SKILL.md

bundled-skills/sql-injection-testing/SKILL.mdView on unpkg · L418

bundled-skills/docs/contributors/examples.mdView file

462patternName = generic_password severity = medium line = 462 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in bundled-skills/docs/contributors/examples.md

bundled-skills/docs/contributors/examples.mdView on unpkg · L462

526patternName = generic_password severity = medium line = 526 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in bundled-skills/docs/contributors/examples.md

bundled-skills/docs/contributors/examples.mdView on unpkg · L526

607patternName = generic_password severity = medium line = 607 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in bundled-skills/docs/contributors/examples.md

bundled-skills/docs/contributors/examples.mdView on unpkg · L607

632patternName = generic_password severity = medium line = 632 matchedText = passwo...

Medium

bundled-skills/electron-development/SKILL.mdView file

541patternName = generic_password severity = medium line = 541 matchedText = read -rs...WORD

Medium

Secret Pattern

Hardcoded password in bundled-skills/electron-development/SKILL.md

bundled-skills/electron-development/SKILL.mdView on unpkg · L541

548patternName = generic_password severity = medium line = 548 matchedText = read -rs...WORD

Medium

Secret Pattern

Hardcoded password in bundled-skills/electron-development/SKILL.md

bundled-skills/electron-development/SKILL.mdView on unpkg · L548

Source & flagged code

39 flagged · loading source

bundled-skills/docs/maintainers/full-repo-audit-2026-05-23.mdView file

262patternName = aws_access_key severity = critical line = 262 matchedText = - Eviden...der.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bundled-skills/docs/maintainers/full-repo-audit-2026-05-23.mdView on unpkg · L262

262patternName = aws_access_key severity = critical line = 262 matchedText = - Eviden...der.

Critical

Secret Pattern

AWS access key ID in bundled-skills/docs/maintainers/full-repo-audit-2026-05-23.md

bundled-skills/docs/maintainers/full-repo-audit-2026-05-23.mdView on unpkg · L262

262patternName = private_key_rsa severity = critical line = 262 matchedText = - Eviden...der.

Critical

Secret Pattern

RSA private key in bundled-skills/docs/maintainers/full-repo-audit-2026-05-23.md

bundled-skills/docs/maintainers/full-repo-audit-2026-05-23.md

Findings

6 Critical6 High32 Medium6 Low

CriticalCritical Secretbundled-skills/docs/maintainers/full-repo-audit-2026-05-23.md

CriticalPrevious Version Dangerous Deltabundled-skills/competitor-analysis/scripts/gate_candidates.mjs

CriticalSecret Patternbundled-skills/rclone-cli/references/providers/sftp.md

CriticalSecret Patternbundled-skills/docs/maintainers/full-repo-audit-2026-05-23.md

HighChild Processbundled-skills/playwright-skill/run.js

HighShell

HighCredential Exfiltrationbundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsx

HighRuntime Package Install

Affected versions and remediation

This report applies to opencode-skills-collection@3.1.21.

See all versions of opencode-skills-collection for other recorded verdicts.

Review the evidence and your use of opencode-skills-collection@3.1.21 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-12 01:27:20.307Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.