opencode-responses-bridge-skill

• Outcome: Review
• Latest audit: Aug 8, 2026 · 7:50 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent local protocol bridge, but it automatically stores sensitive prompt and upstream request data in local debug files without enough scoping or retention controls.

Install only if you are comfortable with a local proxy forwarding your conversations to the configured upstream and writing request content into files beside the script. Avoid using it with confidential prompts unless you disable or modify logging, run it on a private machine, keep it bound to localhost, and clean up proxy-requests.log, proxy-last-upstream.json, and proxy-last-error.txt after troubleshooting.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The README makes a strong security claim that API keys are never written to disk, yet the documented debug behavior says full inbound requests and upstream payloads are dumped to local files. If those dumps include HTTP headers or sensitive prompt contents, users may persist API keys, conversation data, tool arguments, or uploaded content to disk contrary to the stated guarantee, creating credential and privacy exposure.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The README states that API keys are not written to disk, but elsewhere documents that full inbound requests and upstream payloads are persisted locally. Full request bodies commonly contain prompts, conversation history, tool arguments, and may also include sensitive headers or tokens depending on implementation, so this contradiction can mislead users into exposing secrets unintentionally.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The security section claims keys are not persisted, while the debugging section says complete inbound requests and upstream payloads are dumped to files. Contradictory security documentation creates a real security risk because operators may rely on the safer claim and run the proxy in environments where confidential prompts, attachments, or credentials must not be stored.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation says keys are not persisted, but it also instructs users to inspect on-disk log and debug artifacts such as request summaries and last-request files. Even if authorization headers are redacted, proxied request bodies, prompts, tool outputs, or error payloads may contain sensitive data, creating a real risk of local secret or prompt leakage and undermining the stated security boundary.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script defines persistent log and dump files for requests, upstream payloads, and errors, which expands the data-retention surface beyond a simple protocol bridge. Even with authorization redaction, these files can retain sensitive prompts, tool outputs, and service error details on disk where other local users, backups, or forensic tooling may access them.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The handler logs request metadata and writes request bodies plus translated upstream payloads to disk, which can capture full conversation content, attachments/URLs, tool arguments, and possibly secrets embedded in prompts. Because this happens automatically for every request, the proxy creates a durable local copy of sensitive data unrelated to its core bridging function.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Documenting full request and upstream payload dumps without an explicit warning encourages users to enable or rely on logging that may capture private prompts, model outputs, tool-call arguments, and possibly embedded images or data URLs. In a local proxy context, this increases the chance of unintentional data retention and later disclosure through backups, shared machines, or support bundles.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises request logging and dump files without clearly warning that user prompts, chat history, tool inputs, and multimodal content may be written to local disk. In an agent/proxy context this data is often highly sensitive, so insufficient warning increases the chance of accidental disclosure through local files, backups, or shared workstations.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Incoming request bodies are appended to a local log file without user-facing disclosure or consent. Prompts frequently contain credentials, proprietary data, or personal information, so this creates avoidable persistence and secondary exposure risk on the host system.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The translated upstream payload is dumped verbatim to disk, preserving the normalized request that will be sent to the model provider. This may include full prompts, system instructions, tool schemas, and model parameters, creating an unnecessary at-rest copy of sensitive material.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: Writing upstream error bodies to disk can persist provider-side diagnostics that may echo request fragments, internal identifiers, or other sensitive operational details. While lower risk than full request logging, it still broadens data exposure and can leak troubleshooting information to anyone with local file access.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill describes a local proxy that forwards Chat Completions traffic to a configurable upstream Responses API, but it does not explicitly warn users that prompts, tool outputs, images, and potentially sensitive request metadata are transmitted to another service. In a proxy/bridge context, that omission can cause users to unknowingly send confidential data off-host, especially because the documentation emphasizes local use and compatibility rather than data-flow disclosure.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly says full inbound requests and upstream payloads are written to disk, which introduces a straightforward sensitive-data exposure risk. Because this proxy handles model prompts and responses, those files may contain proprietary data, personal information, credentials embedded in prompts, or tool-call arguments.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.