registry / opencode-skills-collection / 4.0.53
opencode-skills-collection@4.0.53
OpenCode CLI plugin that automatically downloads and keeps skills up to date.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a first-party OpenCode extension that automatically mutates its package-owned skill area at platform startup and ships dangerous user-invoked helpers. No npm install hook, runtime exfiltration, remote payload loading, or broad foreign control-surface mutation was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
OpenCode startup after the user configured this package as a plugin; separate helper behavior requires an explicit command.
Impact
It can replace or remove package-managed vault content and make bundled instructions and tools available to the agent. No automatic npm-install execution, secret collection, or package-runtime network exfiltration was found.
Mechanism
OpenCode skill-vault synchronization and bundled user-invoked automation tools.
AI rationale
This is a first-party OpenCode extension that automatically mutates its package-owned skill area at platform startup and ships dangerous user-invoked helpers. No npm install hook, runtime exfiltration, remote payload loading, or broad foreign control-surface mutation was found.
Evidence
dist/index.jsdist/skill-pointer/vault-installer.jsbundled-skills/playwright-skill/run.js~/.config/opencode/skills~/.config/opencode/skill-librariesbundled-skills/playwright-skill/.temp-execution-<timestamp>.js
Network endpoints1
api.apify.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The OpenCode plugin runs on startup and creates the user's OpenCode skills directory.
- It copies the bundled skill collection into the OpenCode vault and removes vault entries not in its index.
- A bundled Playwright helper can install dependencies and execute code supplied by its caller.
Evidence against
- package.json has no preinstall, install, or postinstall hook; prepublishOnly only builds before publishing.
- The plugin runtime contains no network client or child-process invocation.
- The Apify and Playwright helpers are bundled reference tools that require explicit invocation and use named service endpoints.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcebundled-skills/developer-signup-flow/SKILL.mdView file
165patternName = stripe_test_secret
severity = high
line = 165
High
High Secret
Package contains a high-severity secret pattern.
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165165patternName = stripe_test_secret
severity = high
line = 165
High
Secret Pattern
Stripe test secret key in bundled-skills/developer-signup-flow/SKILL.md
bundled-skills/developer-signup-flow/SKILL.mdView on unpkg · L165bundled-skills/playwright-skill/run.jsView file
12L13: const fs = require('fs');
L14: const path = require('path');
Medium
Dynamic Require
Findings
1 Critical6 High7 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationbundled-skills/apify-content-analytics/reference/scripts/run_actor.js
HighHigh Secretbundled-skills/developer-signup-flow/SKILL.md
HighCredential Exfiltrationbundled-skills/huggingface-tool-builder/references/baseline_hf_api.tsx
HighShips High Entropy Blobbundled-skills/theme-factory/theme-showcase.pdf
HighPayload In Excluded Dirbundled-skills/fedora-hyprland-installer/tests/test-scripts.sh
HighSemantic Analysis Limitedbundled-skills/go-in-depth/scripts/workflow-script.js
HighSecret Patternbundled-skills/developer-signup-flow/SKILL.md
MediumDynamic Requirebundled-skills/playwright-skill/run.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to opencode-skills-collection@4.0.53.
See all versions of opencode-skills-collection for other recorded verdicts.
- Review the evidence and your use of opencode-skills-collection@4.0.53 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.