dev-coding-agent

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:29 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward OpenCode helper for user-directed coding work, with disclosed file-modifying behavior and no hidden persistence or exfiltration in the artifact.

Install only if you intend to let OpenCode make changes in your repositories. Prefer a reviewed or pinned OpenCode version, run it in a git repo or disposable workspace, monitor any background task, and inspect diffs before keeping generated changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:75

Finding

Unpinned Global Installation of a Third-Party CLI Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 75
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Complete Code Snippet:

markdown

- OpenCode CLI installed (`npm install -g opencode`)

Technical Analysis

The documented command installs the latest available release of the opencode npm package globally without pinning an exact version, validating package integrity, or identifying a reviewed package source. Consequently, the code installed and executed can change after this skill has been reviewed.

npm installation may execute package lifecycle scripts with the installing user's privileges. A global installation also makes the resulting executable available outside an isolated project environment. The repository contains no lockfile, integrity value, or bundled implementation that establishes which package version and content users will receive.

This is a supply-chain weakness rather than evidence that the current package is malicious.

Attack Path

1. An attacker compromises the upstream package, a maintainer account, or a future package release.
2. The attacker publishes a malicious version under the package name referenced by the documentation.
3. A user follows the documented npm install -g opencode command.
4. npm resolves and downloads the attacker-controlled release because no exact version is pinned.
5. Malicious lifecycle code can execute during installation, or malicious behavior can execute later when the globally installed opencode command is invoked.
6. The payload operates with the permissions of the user performing the installation or running the CLI.

Impact Assessment

Successful exploitation could provide code execution with the installing user's privileges. Depending on that user's permissions and environment, the payload could access source repositories, modify project files, read user-accessible credentials or ...[truncated 369 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version rather than resolving the latest release:

   bash

   npm install -g opencode@<reviewed-exact-version>
   

2. Document the authoritative registry, publisher, and expected package identity so users can detect namespace confusion or package substitution.
3. Prefer a project-local or otherwise isolated installation over a global installation, and commit an appropriate lockfile when the surrounding workflow supports one.
4. Verify package provenance, signatures, and integrity metadata before installation.
5. Disable lifecycle scripts during installation when they are not required:

   bash

   npm install --ignore-scripts opencode@<reviewed-exact-version>
   

6. If lifecycle scripts are necessary, audit them and their transitive dependencies before recommending installation.
7. Run the CLI with least privilege in a sandbox or disposable development environment, granting access only to the intended repository and required credentials.
8. Establish a controlled update process in which new versions are reviewed and tested before changing the documented pin.

SkillSpector

Vulnerability Patterns

• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

---

name: dev-coding-agent description: 'Enhanced coding agent for development workflows. Optimized for building features, fixing bugs, and code refactoring with OpenCode integration.' metadata: { "openclaw": { "emoji": "👨‍💻", "requires": { "anyBins": ["opencode"] } }, "author": "Roger", "version": "1.0.0" }

Development Coding Agent

Specialized coding agent skill optimized for software development tasks using OpenCode.

Quick Start

Basic Usage

bash

# Simple task in your project
bash pty:true workdir:~/your-project command:"opencode run 'Add feature or fix bug'"

# Background ta

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill encourages running opencode to modify project code, including in background:true mode, without warning that these commands can change files, introduce unsafe code, or continue unattended. In an agent-skill context, this increases the chance of unintended repository modifications or unreviewed automated changes being applied in a user's workspace.

Content

No source excerpt is available for this finding.