opencode-skills-collection@4.0.26
OpenCode CLI plugin that automatically downloads and keeps skills up to date.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Decision evidence
public snapshotSource & flagged code
8 flagged · loading sourcePackage contains a high-severity secret pattern.
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165Stripe test secret key in bundled-skills/developer-signup-flow/SKILL.md
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165Package source references dynamic require/import behavior.
bundled-skills/playwright-skill/run.jsView on unpkg · L12Source combines credential-like environment material and outbound requests; review data flow before blocking.
bundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsxView on unpkg · L39Package ships non-JavaScript build or shell helper files.
bundled-skills/gemini-deep-research/scripts/research.pyView on unpkgPackage ships compressed or archive-like blobs.
bundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkgPackage ships high-entropy non-source blobs.
bundled-skills/theme-factory/theme-showcase.pdfView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
bundled-skills/fedora-hyprland-installer/tests/test-scripts.shView on unpkgFindings
Affected versions and remediation
This report applies to opencode-skills-collection@4.0.26.
See all versions of opencode-skills-collection for other recorded verdicts.
- Review the evidence and your use of opencode-skills-collection@4.0.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.