Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent OpenCode helper, but it documents network-exposed server mode and privileged global installation steps without enough safety guidance.
Review the installation commands before using them, prefer a user-owned skills directory if OpenClaw supports it, avoid the symlink workflow for untrusted content, and do not bind the web interface to `0.0.0.0` unless it is protected by authentication, firewalling, and a trusted network. Treat any OpenCode run with attached files or project directories as potentially sending code/context to configured AI providers.
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T09 · Insecure Skill Coding Practices
Error
Location
CHEATSHEET.md:243
Finding
Web Interface May Be Exposed Without Required Access Controls
Content
View full analysis
Vulnerability Details
File Location: CHEATSHEET.md, lines 243–253 Vulnerability Type: Unauthenticated network service exposure Risk Level: High
Vulnerable Code
bash
## Web Interface
# Default settings
opencode web
# Custom port
opencode web --port 8080
# Custom host
opencode web --hostname 0.0.0.0
Technical Analysis
The documentation recommends binding the OpenCode web interface to 0.0.0.0, which causes the service to listen on every available network interface. The example does not require authentication, TLS, firewall restrictions, or source-address allowlisting, and it does not warn users that this configuration may expose the service beyond the local machine.
If OpenCode does not independently enforce suitable access controls, any host able to reach the configured port could interact with the web interface. Because OpenCode is an AI coding agent, the exposed functionality may include project and session access, source-code inspection, file modification, and agent operations executed with the service owner's operating-system permissions.
The issue is an insecure documented configuration. Whether it is exploitable on a particular installation depends on OpenCode's runtime authentication defaults and the host's network and firewall configuration.
Attack Path
A user follows the documented example and executes:
bash
opencode web --hostname 0.0.0.0
potentially together with --port 8080.
OpenCode binds its web service to all network interfaces.
The host firewall, cloud security group, container port mapping, or local network allows an attacker to reach the listening port.
The attacker discovers the service through network scanning or prior knowledge.
If the service lacks effective authentication, the attacker accesses the web interface.
The attacker inspects exposed project or session data and invokes any operations made available by the interface.
Impact Assessment
A suc
...[truncated 564 chars]
Remediation
View remediation
Remediation Suggestions
Replace the all-interface binding example with an explicit loopback binding:
bash
opencode web --hostname 127.0.0.1 --port 8080
Remove 0.0.0.0 from general quick-start documentation or place it in an advanced deployment section with a prominent security warning.
If remote access is necessary, require authentication and use a strong, unique secret. Do not place credentials directly in shell history or committed files.
Terminate TLS through a securely configured reverse proxy or use another authenticated encrypted tunnel.
Restrict inbound traffic with host firewalls, cloud security groups, or source-address allowlists.
Run OpenCode under a dedicated, unprivileged account with access only to the required project directories.
Disable unnecessary plugins, MCP servers, command execution, and provider capabilities when operating in server mode.
Document a verification step that confirms the service is not publicly reachable and that unauthenticated requests are rejected.
The example opencode web --hostname 0.0.0.0 binds the web interface to all network interfaces, potentially exposing the service beyond localhost. Without any warning about authentication, trusted-network assumptions, firewalling, or reverse-proxy hardening, users may unintentionally publish an AI/code interface that could allow unauthorized access or leakage of project data.
Content
No source excerpt is available for this finding.
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content
Scanner excerpt · INSTALL.md (reported line 172)May include surrounding context.
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
Content
Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.
md
opencode github --help # GitHub agent options
# MCP Servers
opencode mcp list # List MCP servers
opencode mcp add # Add MCP server
opencode mcp auth [name] # OAuth for MCP server
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The cheat sheet encourages use of AI-assisted commands, including attaching files and operating on project directories, without warning that prompts and file contents may be transmitted to external model providers. In a coding/IDE skill, this omission can lead users to unintentionally send proprietary code, secrets, or regulated data to third parties.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
Lines L078-L079 show opencode session delete <sessionID>, which is an irreversible/destructive operation affecting stored session data. In this markdown file, there is no adjacent warning, caution, or note that deleting a session may permanently remove conversation history.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
The document instructs users to copy files into a system-wide Node modules directory using sudo, which modifies privileged locations without any warning, validation, or safer alternative. In a skill consumed by an AI agent ecosystem, such instructions can normalize unsafe installation behavior and increase the chance of unintended system changes or persistence of untrusted content.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
92% confidence
Finding
This explicit sudo command directs users to copy the skill into a privileged system directory. If the skill contents are malicious or have been tampered with, this step grants them persistence in a trusted location and increases blast radius by requiring elevated privileges.
Content
Scanner excerpt · INDEX.md (reported line 35)May include surrounding context.
The development workflow again includes a sudo copy into a global application directory, but provides no warning about the risk of overwriting installed skills or modifying trusted runtime components. Because this is framed as a routine dev step, users may execute it reflexively, enabling accidental privilege misuse or deployment of tampered skill content into a trusted path.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
91% confidence
Finding
The development instructions include another sudo copy into a global runtime path, effectively encouraging privileged deployment of locally edited content. This is risky because a compromised workspace or accidental modification can be promoted into a trusted execution context with root-assisted installation.
Content
Scanner excerpt · INDEX.md (reported line 139)May include surrounding context.
All instructional content in this skill file is presented in Chinese, and there is no indication that the skill is intended only for a Chinese-speaking or region-specific audience. Under the language/locale policy, forcing a single language without user opt-in or documented justification is a natural-language policy violation.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
This markdown file instructs users to run sudo cp -r into a system directory and later sudo rm -rf to uninstall, which can affect system integrity if paths are wrong or the target installation differs. The guide provides commands and a backup note, but it does not include a clear user-facing warning that these privileged operations modify system files and that rm -rf is destructive.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content
Scanner excerpt · INSTALL.md (reported line 21)May include surrounding context.
Creating a root-level symbolic link from a mutable user-writable workspace into OpenClaw's trusted global skills directory weakens trust boundaries. If the workspace contents later change, the application may load modified skill content without an explicit reinstall or integrity check, enabling persistence or unintended code/instruction changes.
Content
Scanner excerpt · INSTALL.md (reported line 50)May include surrounding context.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content
Scanner excerpt · INSTALL.md (reported line 117)May include surrounding context.
检查文件位置：
bash
ls -la /usr/local/lib/node_modules/openclaw/skills/opencode/SKILL.md
检查语法：
Skill Enumeration
Medium
Category
Agent Snooping
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content
Scanner excerpt · INSTALL.md (reported line 123)May include surrounding context.
检查文件位置：
bash
ls -la /usr/local/lib/node_modules/openclaw/skills/opencode/SKILL.md
检查语法：
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The README encourages use of AI-driven code editing, PR handling, and session continuation without clearly warning that these operations can modify source files, branches, pull requests, or other repository state. In a skill meant to run agents on codebases, omission of modification-risk warnings can lead users to invoke destructive or unintended actions with incomplete understanding.
Content
No source excerpt is available for this finding.
Static analysis
Detected: suspicious.destructive_delete_command
Documentation contains a destructive delete command without an explicit confirmation gate.
