OpenCode Remote

• Outcome: Review
• Latest audit: May 29, 2026 · 9:23 PM UTC
• Version: 1.0.0

Overview

This is a real remote OpenCode management skill, but it includes powerful remote shell, deletion, proxying, and automatic monitoring behavior that users should review carefully before installing.

Install only if you trust the target OpenCode server, network path, and any local SOCKS proxy. Prefer HTTPS or a trusted private network, avoid sending secrets, verify the endpoint before each action, disable monitoring when no longer needed, and treat shell, delete, abort, and fork operations as privileged actions that should require explicit user confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill clearly instructs use of shell commands, network access, local file reads/writes, and scheduled monitoring, yet declares no permissions. This creates a misleading trust boundary: a reviewer or runtime may treat it as lower risk than it really is, while the skill can transmit data externally and persist state locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose focuses on remote session management and monitoring, but the behavior includes materially broader capabilities such as deleting/forking sessions, summarizing, stopping running sessions, executing shell commands in sessions, enumerating sub-sessions, and writing persistent local mappings. This mismatch can mislead users into authorizing a skill that performs more powerful and potentially destructive actions than advertised.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The reference documents PTY creation/connection and shell execution, which materially expands the skill from session management into arbitrary remote command execution and interactive terminal access. In the context of a remote-operation skill over HTTP, exposing these capabilities without clear scope restriction or guardrails can enable full remote system control if surfaced to an agent or user unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The API reference includes filesystem access, configuration changes, MCP administration, and PTY management that go well beyond the stated purpose of managing remote OpenCode sessions. For a skill intended for session/task management, this hidden breadth increases the risk of overprivileged use, unintended data exposure, and unauthorized administrative changes on the remote server.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: All API traffic is forcibly routed through a hard-coded local SOCKS5 proxy, which can silently redirect sensitive session metadata and message contents to an unintended intermediary. In a remote-session management skill, this broad hidden network redirection is more dangerous because the tool handles operational data and users may assume direct server communication.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The client exposes a remote shell execution capability via `/session/{id}/shell`, which materially exceeds the manifest’s described scope of session management, monitoring, and messaging. In this skill context, that creates a high-risk hidden capability because a user or downstream automation may believe the tool only manages sessions while it can actually trigger arbitrary command execution on the remote OpenCode server.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The code supports deleting sessions even though the manifest does not describe destructive deletion capability. This is a risky scope mismatch because users may invoke the skill expecting non-destructive remote management, while the tool can permanently remove remote state and cause operational or data loss.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The skill instructs recording session metadata to a local file without clearly warning that this creates persistent storage of remote endpoints, session IDs, task descriptions, and timestamps. Even if not immediately exploitable, this can leave sensitive operational data behind on disk and expose it to later unauthorized access.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The automatic 5-minute monitoring repeatedly polls remote session state, collects todo progress and message content, and reports results back without an explicit privacy warning or opt-in. Continuous polling increases the volume of collected data and can surface remote outputs the user did not intend to retrieve or redistribute.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: Destructive session deletion is documented as a simple endpoint with no caution about permanence, confirmation, or data-loss implications. In an agent-driven environment, omission of such safety context can lead to accidental deletion of conversations, work history, or audit trail data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The shell-command endpoint enables arbitrary command execution on the remote host, yet the documentation provides no warning about system impact, privilege boundaries, or command safety. In a remote agent skill, this is especially dangerous because it can directly lead to host compromise, data destruction, persistence, or lateral movement.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The client sends messages, summaries, and other session data to a remote server, and optionally through a configured proxy, without any explicit notice about sensitive-data transmission. In this skill context, users may send prompts, outputs, or operational details they assume are local, so silent network transmission increases confidentiality risk, especially when plain HTTP or an untrusted proxy is used.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The delete operation performs an irreversible destructive action without any confirmation, dry-run, or warning. In a remote session-management tool, this makes accidental or script-driven data loss much more likely, especially because session identifiers may be pasted or reused incorrectly.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The shell feature triggers arbitrary remote command execution without any explicit warning, confirmation, or safety boundary. Given the skill’s stated purpose of session management and messaging, this is especially dangerous because it can lead to server compromise, destructive actions, or exfiltration if invoked unintentionally or by a user who does not realize the capability exists.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The instruction to always repeat the full prompt verbatim back to the user can expose secrets, credentials, proprietary text, or sensitive instructions in plain language. If prompts contain confidential data or are assembled from prior context, this requirement amplifies leakage by duplicating the sensitive content.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The monitoring workflow requires summarizing latest messages and, on completion, reporting full final outputs. This creates an ongoing plain-language disclosure channel for potentially sensitive remote session content, especially because the collection is periodic and automatic rather than a one-time user-reviewed action.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.