registry / opencode-skills-collection / 4.0.39
opencode-skills-collection@4.0.39
OpenCode CLI plugin that automatically downloads and keeps skills up to date.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a guarded same-platform agent extension that modifies OpenCode-owned skill paths at startup and ships a powerful user-invoked automation runner. Its capabilities merit a warning, but the inspected source does not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
OpenCode startup for skill installation; explicit invocation of bundled-skills/playwright-skill/run.js for automation.
Impact
Changes the package-managed OpenCode skills/control surface and can execute user-provided browser automation; no confirmed unconsented payload execution or data exfiltration.
Mechanism
same-platform skill-library installation plus user-invoked browser automation
AI rationale
This is a guarded same-platform agent extension that modifies OpenCode-owned skill paths at startup and ships a powerful user-invoked automation runner. Its capabilities merit a warning, but the inspected source does not establish malicious behavior.
Evidence
dist/index.jsdist/skill-pointer/index.jsdist/skill-pointer/vault-installer.jsdist/skill-pointer/pointer-generator.jsbundled-skills/playwright-skill/run.jspackage.jsonbundled-skillsskills_index.json~/.config/opencode/skill-libraries~/.config/opencode/skills
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runs on every OpenCode startup and creates OpenCode skill directories.
- Copies bundled skills into the OpenCode vault, overwriting managed entries and deleting unlisted vault entries.
- A bundled Playwright utility can install dependencies/browser binaries and execute user-supplied code when manually invoked.
Evidence against
- No npm preinstall/install/postinstall hook; prepublishOnly only builds before publishing.
- No runtime network client in the plugin entry point.
- The Hugging Face token example sends its token only as authorization to the explicitly requested Hugging Face API endpoint and prints the response.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcebundled-skills/developer-signup-flow/SKILL.mdView file
165patternName = stripe_test_secret
severity = high
line = 165
matchedText = sk[redacted]]
High
High Secret
Package contains a high-severity secret pattern.
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165165patternName = stripe_test_secret
severity = high
line = 165
matchedText = sk[redacted]]
High
Secret Pattern
Stripe test secret key in bundled-skills/developer-signup-flow/SKILL.md
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165bundled-skills/playwright-skill/run.jsView file
12L13: const fs = require('fs');
L14: const path = require('path');
Medium
Findings
5 High7 Medium6 Low
HighHigh Secretbundled-skills/developer-signup-flow/SKILL.md
HighCredential Exfiltrationbundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsx
HighShips High Entropy Blobbundled-skills/theme-factory/theme-showcase.pdf
HighPayload In Excluded Dirbundled-skills/fedora-hyprland-installer/tests/test-scripts.sh
HighSecret Patternbundled-skills/developer-signup-flow/SKILL.md
MediumDynamic Requirebundled-skills/playwright-skill/run.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbundled-skills/gemini-deep-research/scripts/research.py
MediumShips Compressed Blobbundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gz
Medium
Affected versions and remediation
This report applies to opencode-skills-collection@4.0.39.
See all versions of opencode-skills-collection for other recorded verdicts.
- Review the evidence and your use of opencode-skills-collection@4.0.39 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.