registry / roleflow / 1.0.2

roleflow@1.0.2

Roleflow: sistema OpenCode portable con roles por responsabilidad + routing barato + ahorro de tokens. Público, instalable desde cualquier PC o server con una línea en opencode.json.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically writes agent instructions and skills into shared global OpenCode configuration. These writes are neither restricted to a roleflow namespace nor guarded by explicit consent.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation running the postinstall lifecycle hook.

Impact

Existing global agent behavior can be replaced, affecting subsequent OpenCode sessions across projects.

Mechanism

Recursive filesystem copying installs generic agent and skill names into the user's OpenCode control surface and can overwrite existing files.

Policy narrative

The installation lifecycle invokes postinstall.mjs, which locates the user's global OpenCode configuration and recursively copies bundled agents and skills into it. The hook has no opt-in gate or protection for existing files. Generic agent names can therefore replace previously configured behavior across projects. This constitutes unconsented install-time mutation of a foreign, shared AI-agent control surface under the supplied policy.

AI rationale

The source establishes automatic, unguarded writes to OpenCode's shared agent control surface, meeting the explicit blocking rule. Ordinary workflow content and the absence of exfiltration do not remove that concrete install-time behavior. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsonpostinstall.mjs~/.config/opencode/agents~/.config/opencode/skills

roleflow@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code