registry / opencode-skills-collection / 4.0.51
opencode-skills-collection@4.0.51
OpenCode CLI plugin that automatically downloads and keeps skills up to date.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package automatically mutates an AI-agent skill surface at runtime, creating meaningful capability and instruction risk. The absence of npm install hooks and of entrypoint network activity does not establish a concrete malware or exfiltration chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
OpenCode startup after the user configures this package as a plugin.
Impact
The package can materially expand the agent's instruction and capability surface; bundled command tools may then be invoked by an agent or user.
Mechanism
Automatic agent-skill installation and pointer generation.
AI rationale
The package automatically mutates an AI-agent skill surface at runtime, creating meaningful capability and instruction risk. The absence of npm install hooks and of entrypoint network activity does not establish a concrete malware or exfiltration chain.
Evidence
dist/index.jsdist/skill-pointer/vault-installer.jsdist/skill-pointer/pointer-generator.jsbundled-skills/apify-audience-analysis/reference/scripts/run_actor.js~/.config/opencode/skills~/.config/opencode/skill-libraries
Network endpoints1
api.apify.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The OpenCode plugin runs its skill-installation pipeline on every OpenCode startup.
- It copies the bundled skill collection into the OpenCode vault and removes vault entries not in its index.
- It writes generated SKILL.md pointers into OpenCode's active skills directory, changing the agent's available instructions.
- Bundled examples include user-invoked API clients that send the supplied Apify token to api.apify.com.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The inspected Apify and Hugging Face clients use only their named service endpoints and require explicit command execution.
- No network activity was found in the plugin entrypoint or its installation pipeline.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
10 flagged · loading sourcebundled-skills/developer-signup-flow/SKILL.mdView file
165patternName = stripe_test_secret
severity = high
line = 165
High
High Secret
Package contains a high-severity secret pattern.
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165165patternName = stripe_test_secret
severity = high
line = 165
High
Secret Pattern
Stripe test secret key in bundled-skills/developer-signup-flow/SKILL.md
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165bundled-skills/playwright-skill/run.jsView file
12L13: const fs = require('fs');
L14: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bundled-skills/playwright-skill/run.jsView on unpkg · L12bundled-skills/apify-content-analytics/reference/scripts/run_actor.jsView file
98const apiActorId = actorId.replace('/', '~');
L99: const url = `https://api.apify.com/v2/acts/${apiActorId}/runs?token=${encodeURIComponent(token)}`;
L100:
...
L102: try {
L103: data = JSON.parse(inputJson);
L104: } catch (e) {
...
L114: },
L115: body: JSON.stringify(data),
L116: });
...
L321: // Check for APIFY_TOKEN
L322: const token = process.env.APIFY_TOKEN;
L323: if (!token) {
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
bundled-skills/apify-content-analytics/reference/scripts/run_actor.jsView on unpkg · L98bundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsxView file
39L40: const token = process.env.HF_TOKEN;
L41: const headers: Record<string, string> = token
...
L44:
L45: const url = `https://huggingface.co/api/models?limit=${limit}`;
L46:
...
L54:
L55: const text = await res.text();
L56: process.stdout.write(text);
L57: })();
High
Credential Exfiltration
Source combines credential-like environment material and outbound requests; review data flow before blocking.
bundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsxView on unpkg · L39bundled-skills/gemini-deep-research/scripts/research.pyView file
•path = bundled-skills/gemini-deep-research/scripts/research.py
kind = build_helper
sizeBytes = 24204
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
bundled-skills/gemini-deep-research/scripts/research.pyView on unpkgbundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView file
•path = bundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gz
kind = compressed_blob
sizeBytes = 19967
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
bundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkgbundled-skills/theme-factory/theme-showcase.pdfView file
•path = bundled-skills/theme-factory/theme-showcase.pdf
kind = high_entropy_blob
sizeBytes = 124310
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
bundled-skills/theme-factory/theme-showcase.pdfView on unpkgbundled-skills/fedora-hyprland-installer/tests/test-scripts.shView file
•path = bundled-skills/fedora-hyprland-installer/tests/test-scripts.sh
kind = payload_in_excluded_dir
sizeBytes = 1740
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
bundled-skills/fedora-hyprland-installer/tests/test-scripts.shView on unpkgbundled-skills/go-in-depth/scripts/workflow-script.jsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
bundled-skills/go-in-depth/scripts/workflow-script.jsView on unpkgFindings
1 Critical6 High7 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationbundled-skills/apify-content-analytics/reference/scripts/run_actor.js
HighHigh Secretbundled-skills/developer-signup-flow/SKILL.md
HighCredential Exfiltrationbundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsx
HighShips High Entropy Blobbundled-skills/theme-factory/theme-showcase.pdf
HighPayload In Excluded Dirbundled-skills/fedora-hyprland-installer/tests/test-scripts.sh
HighSemantic Analysis Limitedbundled-skills/go-in-depth/scripts/workflow-script.js
HighSecret Patternbundled-skills/developer-signup-flow/SKILL.md
MediumDynamic Requirebundled-skills/playwright-skill/run.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbundled-skills/gemini-deep-research/scripts/research.py
MediumShips Compressed Blobbundled-skills/web-artifacts-builder/scripts/shadcn-components.tar.gz
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to opencode-skills-collection@4.0.51.
See all versions of opencode-skills-collection for other recorded verdicts.
- Review the evidence and your use of opencode-skills-collection@4.0.51 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.