Security audit

easy-opencode

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad Opencode delegation wrapper that is not clearly malicious, but it gives an external coding tool wide repository authority with unsafe command templates and limited scoping.

Install only if you intentionally want repository coding tasks routed through Opencode. Use it on trusted repositories, avoid sensitive or production-impacting tasks without explicit review, and prefer safe process invocation over copying the shown shell templates with raw paths or user text.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Mandatory Delegation Causes Skill Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:20
Finding: Shell Command Injection Through Unsafe Command Templates
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description claims applicability to broadly defined coding tasks, which can cause the agent to invoke this skill in many repository contexts without sufficient narrowing or safety gating. Overbroad activation increases the chance that sensitive, destructive, or out-of-scope coding requests are routed to an external tool workflow by default.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instruction to use opencode for 'any problem related to coding of a repository' is ambiguous and effectively delegates a very wide class of tasks to the tool, including potentially risky repository operations. In this skill, the danger is amplified because the workflow mandates direct tool use and states that all planning and coding happen inside Opencode, reducing human constraint and increasing the blast radius of mistaken invocation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.