registry / opencode-skills-collection / 4.0.43
opencode-skills-collection@4.0.43
OpenCode CLI plugin that automatically downloads and keeps skills up to date.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a package-owned agent-extension setup that mutates the OpenCode skill surface at runtime, warranting a warning under policy. Source inspection found no unconsented npm lifecycle mutation, remote payload execution, or exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
OpenCode loads the plugin at startup; the Playwright executor additionally requires an explicit user CLI invocation.
Impact
Bundled agent instructions become available to OpenCode and package-managed vault/pointer content is refreshed or removed.
Mechanism
startup copying and managed skill-pointer generation
AI rationale
This is a package-owned agent-extension setup that mutates the OpenCode skill surface at runtime, warranting a warning under policy. Source inspection found no unconsented npm lifecycle mutation, remote payload execution, or exfiltration.
Evidence
package.jsondist/index.jsdist/skill-pointer/index.jsdist/skill-pointer/vault-installer.jsdist/skill-pointer/pointer-generator.jsbundled-skills/playwright-skill/run.jsbundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsx~/.config/opencode/skill-libraries~/.config/opencode/skillsbundled-skills/playwright-skill/.temp-execution-<timestamp>.js
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Runtime plugin automatically writes OpenCode skill pointers on every startup.
- It copies bundled skills into an OpenCode vault and removes vault entries absent from its current index.
- Bundled Playwright runner executes code supplied by its explicit CLI caller.
Evidence against
- No preinstall, install, or postinstall hook; only prepublishOnly is declared.
- No package-runtime network client or credential exfiltration was found.
- The Hugging Face example sends HF_TOKEN only to the documented Hugging Face API when explicitly run.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
8 flagged · loading sourcebundled-skills/developer-signup-flow/SKILL.mdView file
165patternName = stripe_test_secret
severity = high
line = 165
matchedText = sk[redacted]]
High
High Secret
Package contains a high-severity secret pattern.
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165165patternName = stripe_test_secret
severity = high
line = 165
matchedText = sk[redacted]]
High
Secret Pattern
Stripe test secret key in bundled-skills/developer-signup-flow/SKILL.md
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165bundled-skills/playwright-skill/run.jsView file
12L13: const fs = require('fs');
L14: const path = require('path');
Medium
Findings
5 High7 Medium6 Low
HighHigh Secretbundled-skills/developer-signup-flow/SKILL.md
HighCredential Exfiltrationbundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsx
HighShips High Entropy Blobbundled-skills/theme-factory/theme-showcase.pdf
HighPayload In Excluded Dirbundled-skills/fedora-hyprland-installer/tests/test-scripts.sh
HighSecret Patternbundled-skills/developer-signup-flow/SKILL.md
MediumDynamic Requirebundled-skills/playwright-skill/run.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbundled-skills/gemini-deep-research/scripts/research.py
MediumShips Compressed Blobbundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gz
Medium
Affected versions and remediation
This report applies to opencode-skills-collection@4.0.43.
See all versions of opencode-skills-collection for other recorded verdicts.
- Review the evidence and your use of opencode-skills-collection@4.0.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.