registry / opencode-skills-collection / 4.0.45
opencode-skills-collection@4.0.45
OpenCode CLI plugin that automatically downloads and keeps skills up to date.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a first-party OpenCode extension that mutates the agent skill surface at plugin startup, so it warrants a warning under the lifecycle policy. Direct inspection found no concrete malicious chain or unconsented npm lifecycle behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
OpenCode loads the configured plugin at startup.
Impact
The package can influence available agent skills and remove stale directories it manages; no credential theft, remote payload retrieval, or unconsented npm lifecycle mutation was found.
Mechanism
Copies package-managed skills and writes generated OpenCode pointer skills.
AI rationale
This is a first-party OpenCode extension that mutates the agent skill surface at plugin startup, so it warrants a warning under the lifecycle policy. Direct inspection found no concrete malicious chain or unconsented npm lifecycle behavior.
Evidence
package.jsondist/index.jsdist/skill-pointer/index.jsdist/skill-pointer/vault-installer.jsdist/skill-pointer/pointer-generator.jsbundled-skills/playwright-skill/run.jsbundled-skillsskills_index.json~/.config/opencode/skill-libraries~/.config/opencode/skills
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The OpenCode plugin creates its active skill directory and runs a deployment pipeline on every plugin load.
- The pipeline removes stale package-managed vault and pointer directories, then copies bundled skills and writes pointer files.
- A bundled Playwright helper can install browser dependencies and execute code supplied by its caller.
Evidence against
- The npm manifest has only a prepublish build script, with no install or postinstall hook.
- The package entry point has no network request or credential collection logic.
- The code-execution helper is a bundled skill, not called by the package entry point; its execution requires explicit invocation and supplied code.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcebundled-skills/developer-signup-flow/SKILL.mdView file
165patternName = stripe_test_secret
severity = high
line = 165
matchedText = sk[redacted]]
High
High Secret
Package contains a high-severity secret pattern.
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165165patternName = stripe_test_secret
severity = high
line = 165
matchedText = sk[redacted]]
High
Secret Pattern
Stripe test secret key in bundled-skills/developer-signup-flow/SKILL.md
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165bundled-skills/playwright-skill/run.jsView file
12L13: const fs = require('fs');
L14: const path = require('path');
Medium
Findings
5 High7 Medium6 Low
HighHigh Secretbundled-skills/developer-signup-flow/SKILL.md
HighCredential Exfiltrationbundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsx
HighShips High Entropy Blobbundled-skills/theme-factory/theme-showcase.pdf
HighPayload In Excluded Dirbundled-skills/fedora-hyprland-installer/tests/test-scripts.sh
HighSecret Patternbundled-skills/developer-signup-flow/SKILL.md
MediumDynamic Requirebundled-skills/playwright-skill/run.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbundled-skills/gemini-deep-research/scripts/research.py
MediumShips Compressed Blobbundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gz
Medium
Affected versions and remediation
This report applies to opencode-skills-collection@4.0.45.
See all versions of opencode-skills-collection for other recorded verdicts.
- Review the evidence and your use of opencode-skills-collection@4.0.45 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.