Opencode Acp Control

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:45 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for controlling OpenCode, but its update guidance includes broad process termination and an unsafe remote installer command that users should review carefully before installing.

Install only if you are comfortable with an agent starting and controlling OpenCode sessions in your project. Before using the update workflow, require explicit confirmation before killing processes, avoid running the curl-to-bash command, and prefer a verified package manager or signed, pinned release update path.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:284

Finding

Unverified Remote Installer Executed Directly by Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:284
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

markdown

- Suggest manual update: `curl -fsSL https://opencode.dev/install | bash`

Technical Analysis

The documented fallback update command downloads content from an external URL and pipes it directly into Bash. The downloaded response is not pinned to a reviewed version and is not validated using a cryptographic checksum or publisher signature before execution. It also provides no opportunity to inspect the retrieved script.

Consequently, the code that ultimately executes can change after this Skill has been reviewed. Compromise of the installer publication system, hosting account, domain, DNS resolution, TLS termination infrastructure, or another upstream delivery component could turn the command into an arbitrary-code-execution mechanism.

This behavior is unnecessary for the Skill's core ACP session-management functionality. Even as an update fallback, it exceeds the minimum safe execution model because an authenticated, version-pinned artifact can be downloaded and verified without directly connecting network output to a shell.

Attack Path

1. OpenCode's documented automatic update fails or does not produce the expected version.
2. The Skill recommends the manual update command to the user.
3. An attacker compromises or gains influence over the content returned by https://opencode.dev/install, or another component in its delivery path.
4. The user or an automated agent runs the recommended command.
5. curl retrieves the attacker-controlled response.
6. The shell immediately interprets the response as Bash code without integrity verification or inspection.
7. The payload executes with all privileges available to the invoking account.

Impact Assessment

Successful exploitation permits arbitrary command execution with the invoking user's privileges. The payload could r ...[truncated 492 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | bash pipeline from the instructions.
2. Prefer an official package manager or another update mechanism that provides authenticated metadata and reproducible version selection.
3. If a standalone installer is required:
   • Select and download a specific, pinned release.
   • Save the artifact to a non-executable file rather than piping it into a shell.
   • Obtain the expected digest or signature through an authenticated release channel.
   • Verify a pinned SHA-256 checksum or publisher signature before execution.
   • Abort on every verification failure.
   • Allow the user to inspect the downloaded content.
   • Require explicit user approval before executing it.
4. Run the installer with the least-privileged account possible and avoid unnecessary privilege elevation.
5. Document the files, directories, network access, and permissions required by the installer.
6. Where supported, execute installation in a restricted environment and verify the installed binary's version and signature afterward.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill expands from ACP/OpenCode control into general web access by instructing the agent to fetch release information from GitHub. This increases the attack surface because it normalizes outbound network access and introduces trust in remote content and redirect behavior for an operation that can influence later update decisions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill recommends a manual update path that pipes a remotely fetched script directly into bash. This is a classic unsafe pattern because any compromise of the remote host, CDN, TLS trust chain, or install script content can immediately lead to arbitrary code execution on the host running the agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The update workflow instructs the agent to enumerate and kill running OpenCode processes without explicit confirmation that active sessions may be interrupted. In an autonomous agent context, this can cause denial of service, disrupt user work, and potentially terminate unrelated or long-running tasks if process matching is too broad.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 100% confidence

Finding

curl -fsSL https://opencode.dev/install | bash fetches an external script and executes it immediately with shell privileges, with no integrity check or review step. In the context of an agent skill, this is especially dangerous because it operationalizes arbitrary remote code execution as a recommended remediation path.

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

md

If version still doesn't match latest:
- Inform user: "OpenCode auto-update may have failed. Current: X.X.X, Latest: Y.Y.Y"
- Suggest manual update: `curl -fsSL https://opencode.dev/install | bash`

### Update Workflow Summary

Static analysis

No suspicious patterns detected.