ClawHub
Back to skill

Security audit

opencode-model-benchmark

Security checks across malware telemetry and agentic risk

Overview

This skill runs a disclosed benchmark against OpenCode endpoints and does not show hidden data access, persistence, or destructive behavior.

Install only if you are comfortable with the agent making outbound requests to opencode.ai to run model benchmarks. The reviewed script does not request API keys, read local files, or write reports to disk; it prints results to the terminal/conversation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill explicitly instructs users to run a Python benchmark script that performs outbound network access to fetch model lists from documentation and call the OpenCode API, yet the skill declares no permissions. This creates a transparency and governance gap: users and the platform are not clearly informed that the skill will access external network resources, which can bypass expected review or consent boundaries.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.