registry / opencode-skills-collection / 4.0.47
opencode-skills-collection@4.0.47
OpenCode CLI plugin that automatically downloads and keeps skills up to date.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package automatically mutates its own OpenCode extension area and activates pointers to package-controlled skills. It has no npm install hook or source-confirmed exfiltration, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
Starting OpenCode with this plugin enabled.
Impact
Agents may be directed to load and follow package-supplied skill instructions from the global vault.
Mechanism
Global OpenCode skill installation and pointer generation.
AI rationale
The package automatically mutates its own OpenCode extension area and activates pointers to package-controlled skills. It has no npm install hook or source-confirmed exfiltration, so this warrants a warning rather than a block.
Evidence
package.jsondist/index.jsdist/skill-pointer/vault-installer.jsdist/skill-pointer/pointer-generator.js~/.config/opencode/skills~/.config/opencode/skill-libraries~/.config/opencode/skill-filter.jsonc
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The plugin runs on every OpenCode startup and targets the user's OpenCode skills directory.
- It recursively copies the complete bundled skill collection into a global OpenCode vault and removes vault entries not in its index.
- Generated active pointer skills direct the agent to read hidden vault content and follow its instructions.
Evidence against
- package.json has only a publish-time build hook, with no npm install lifecycle hook.
- The runtime code contains no network client, credential harvesting, shell execution, or remote payload loading.
- Deletion is limited to this package's vault and pointer directories, not arbitrary project files.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
8 flagged · loading sourcebundled-skills/developer-signup-flow/SKILL.mdView file
165patternName = stripe_test_secret
severity = high
line = 165
matchedText = sk[redacted]]
High
High Secret
Package contains a high-severity secret pattern.
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165165patternName = stripe_test_secret
severity = high
line = 165
matchedText = sk[redacted]]
High
Secret Pattern
Stripe test secret key in bundled-skills/developer-signup-flow/SKILL.md
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165bundled-skills/playwright-skill/run.jsView file
12L13: const fs = require('fs');
L14: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bundled-skills/playwright-skill/run.jsView on unpkg · L12bundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsxView file
39L40: const token = process.env.HF_TOKEN;
L41: const headers: Record<string, string> = token
...
L44:
L45: const url = `https://huggingface.co/api/models?limit=${limit}`;
L46:
...
L54:
L55: const text = await res.text();
L56: process.stdout.write(text);
L57: })();
High
Credential Exfiltration
Source combines credential-like environment material and outbound requests; review data flow before blocking.
bundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsxView on unpkg · L39bundled-skills/gemini-deep-research/scripts/research.pyView file
•path = bundled-skills/gemini-deep-research/scripts/research.py
kind = build_helper
sizeBytes = 24204
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
bundled-skills/gemini-deep-research/scripts/research.pyView on unpkgbundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView file
•path = bundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gz
kind = compressed_blob
sizeBytes = 19967
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
bundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkgbundled-skills/theme-factory/theme-showcase.pdfView file
•path = bundled-skills/theme-factory/theme-showcase.pdf
kind = high_entropy_blob
sizeBytes = 124310
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
bundled-skills/theme-factory/theme-showcase.pdfView on unpkgbundled-skills/fedora-hyprland-installer/tests/test-scripts.shView file
•path = bundled-skills/fedora-hyprland-installer/tests/test-scripts.sh
kind = payload_in_excluded_dir
sizeBytes = 1740
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
bundled-skills/fedora-hyprland-installer/tests/test-scripts.shView on unpkgFindings
5 High7 Medium6 Low
HighHigh Secretbundled-skills/developer-signup-flow/SKILL.md
HighCredential Exfiltrationbundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsx
HighShips High Entropy Blobbundled-skills/theme-factory/theme-showcase.pdf
HighPayload In Excluded Dirbundled-skills/fedora-hyprland-installer/tests/test-scripts.sh
HighSecret Patternbundled-skills/developer-signup-flow/SKILL.md
MediumDynamic Requirebundled-skills/playwright-skill/run.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbundled-skills/gemini-deep-research/scripts/research.py
MediumShips Compressed Blobbundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gz
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to opencode-skills-collection@4.0.47.
See all versions of opencode-skills-collection for other recorded verdicts.
- Review the evidence and your use of opencode-skills-collection@4.0.47 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.