registry / opencode-skills-collection / 4.0.35
opencode-skills-collection@4.0.35
OpenCode CLI plugin that automatically downloads and keeps skills up to date.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package is not concretely malicious, but it performs startup-time first-party OpenCode extension setup and ships a user-invoked arbitrary automation runner. Per policy, that warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
OpenCode plugin startup; explicit invocation of bundled-skills/playwright-skill/run.js.
Impact
Introduces persistent package-owned agent skills and a deliberate automation-code runner; no unconsented install-time execution or exfiltration was confirmed.
Mechanism
OpenCode skill-vault/pointer installation plus user-supplied Playwright code execution.
AI rationale
This package is not concretely malicious, but it performs startup-time first-party OpenCode extension setup and ships a user-invoked arbitrary automation runner. Per policy, that warrants a warning rather than a block.
Evidence
package.jsondist/index.jsdist/skill-pointer/index.jsdist/skill-pointer/vault-installer.jsbundled-skills/playwright-skill/run.jsbundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsx~/.config/opencode/skills~/.config/opencode/skill-librariesbundled-skills/playwright-skill/.temp-execution-<timestamp>.js
Network endpoints1
huggingface.co/api/models?limit=${limit}
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- OpenCode startup imports the plugin and writes generated skill pointers under ~/.config/opencode/skills.
- The plugin copies the bundled corpus into its OpenCode vault and removes stale entries there.
- Bundled Playwright utility explicitly executes code supplied as a file, argument, or stdin and can install browser dependencies.
- HF example sends an opt-in HF_TOKEN only to huggingface.co.
Evidence against
- package.json has only prepublishOnly; no install-time lifecycle hook.
- Startup writes are confined to the package's OpenCode vault and its suffixed pointer directories.
- No package entrypoint exfiltration, remote payload fetch, credential harvesting, or broad agent-config overwrite was found.
- The Playwright executor is a user-invoked bundled skill, not imported by the package entrypoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
8 flagged · loading sourcebundled-skills/developer-signup-flow/SKILL.mdView file
165patternName = stripe_test_secret
severity = high
line = 165
matchedText = sk[redacted]]
High
High Secret
Package contains a high-severity secret pattern.
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165165patternName = stripe_test_secret
severity = high
line = 165
matchedText = sk[redacted]]
High
Secret Pattern
Stripe test secret key in bundled-skills/developer-signup-flow/SKILL.md
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165bundled-skills/playwright-skill/run.jsView file
12L13: const fs = require('fs');
L14: const path = require('path');
Medium
Findings
5 High7 Medium6 Low
HighHigh Secretbundled-skills/developer-signup-flow/SKILL.md
HighCredential Exfiltrationbundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsx
HighShips High Entropy Blobbundled-skills/theme-factory/theme-showcase.pdf
HighPayload In Excluded Dirbundled-skills/fedora-hyprland-installer/tests/test-scripts.sh
HighSecret Patternbundled-skills/developer-signup-flow/SKILL.md
MediumDynamic Requirebundled-skills/playwright-skill/run.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbundled-skills/gemini-deep-research/scripts/research.py
MediumShips Compressed Blobbundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gz
Medium
Affected versions and remediation
This report applies to opencode-skills-collection@4.0.35.
See all versions of opencode-skills-collection for other recorded verdicts.
- Review the evidence and your use of opencode-skills-collection@4.0.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.