Security audit

opencode

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a broad opencode automation guide, but it includes unsafe cleanup, privileged system changes, unpinned package execution, and archive extraction examples that need review before use.

Install only if you want a broad opencode helper and will review commands before running them. Avoid copying its cleanup, sudo ownership/firewall, unpinned npx, and archive-extraction examples as-is; keep servers local and authenticated where possible, use pinned or built-in tooling, and require explicit confirmation before destructive or privileged operations.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: REFERENCES.md:467
Finding: Destructive System-Wide Temporary Directory Cleanup
Content: View full analysis
Vulnerability Details

File Location: REFERENCES.md, line 467
Vulnerability Type: Destructive cleanup command affecting a shared system directory
Risk Level: High

Vulnerable Code:

bash
# Clean temporary files rm -rf /tmp/*

Technical Analysis

The troubleshooting instructions recommend recursively deleting every visible entry under the shared /tmp directory. This operation is not restricted to files created by OpenCode and does not verify ownership, age, file type, or whether an entry is currently in use.

/tmp commonly contains files, directories, sockets, locks, and intermediate data belonging to unrelated applications and users. When the command is run by an account with sufficient permissions, it crosses the legitimate cleanup boundary of this skill and may remove resources belonging to other processes. The use of recursive forced deletion suppresses confirmation and attempts to continue without interactive safeguards.

Attack Path

A user follows the documented disk-space troubleshooting procedure.

The user executes rm -rf /tmp/*, potentially from a privileged shell or an account with access to other temporary resources.

The command recursively removes accessible entries regardless of which application or user created them.

Applications relying on deleted temporary files, sockets, or state may fail, lose data, or behave unpredictably.

No privilege is acquired by the command itself. The damage is limited by the permissions of the invoking account, but execution with elevated privileges substantially increases the affected scope.

Impact Assessment

Potential consequences include:

Deletion of temporary data belonging to unrelated applications or users.

Interruption of active services and local processes.

Loss of unsaved or in-progress application data.

Removal of sockets, lock files, and temporary state.

Local denial of service.

System-wi ...[truncated 53 chars]
Remediation: View remediation
Remediation Suggestions

Remove the system-wide deletion instruction and replace it with narrowly scoped cleanup logic:

Restrict deletion to a dedicated OpenCode cache or temporary directory.

Resolve and validate the target path before deletion.

Verify that the directory is owned by the current user.

Refuse empty paths, /, /tmp, home directories, and other shared locations.

Display the files selected for deletion before modifying them.

Require explicit confirmation for recursive deletion.

Prefer age-based deletion of known OpenCode artifacts.

A safer example is:

bash
CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/opencode" if [ -d "$CACHE_DIR" ] && [ -O "$CACHE_DIR" ]; then find "$CACHE_DIR" -mindepth 1 -maxdepth 1 -print find "$CACHE_DIR" -mindepth 1 -maxdepth 1 -mtime +7 -delete fi

The implementation should still confirm that the resolved path is the expected application-specific directory before deletion.

T08 · Insecure Dependencies

Warning

Location: SKILL.md:132
Finding: Unpinned Third-Party Packages Executed Through npx
Content: View full analysis
Vulnerability Details

File Locations: SKILL.md, line 132; REFERENCES.md, lines 376–380
Vulnerability Type: Unpinned dependency retrieval and immediate execution
Risk Level: Medium

Vulnerable Code in SKILL.md:

bash
# Node.js static file server npx http-server -p 8080 -c-1 /path/to/project

Vulnerable Code in REFERENCES.md:

bash
# Use npx npx http-server -p 8080 -c-1 /path/to/project # Use nodemon npx nodemon --open /path/to/project/index.html

Technical Analysis

npx can retrieve a package from the configured npm registry when it is not already installed locally and then execute that package immediately. The documented commands do not specify exact package versions, use a lockfile, verify package integrity, or require prior provenance review.

As a result, the effective code executed by these instructions is mutable after the skill has been reviewed. A compromised package release, registry account, dependency chain, registry configuration, or unexpected future version could execute arbitrary code under the invoking user's account.

Attack Path

A user follows the documented project-preview instructions.

The requested package is unavailable locally or npx otherwise resolves it through the configured registry.

npx downloads a mutable package version and its transitive dependencies.

Package installation behavior or runtime code executes with the user's privileges.

A compromised package can read or modify files accessible to the user, access inherited environment variables, or initiate network connections.

Exploitation requires compromise or malicious substitution within the package-resolution path; the audited project does not itself contain such a payload.

Impact Assessment

A malicious resolved package could obtain the same effective privileges as the invoking user. Its potential scope includes:

Reading source code, configu ...[truncated 456 chars]
Remediation: View remediation
Remediation Suggestions

Prefer the already documented standard-library server, which does not implicitly retrieve executable npm packages:

bash
python3 -m http.server 8000 --bind 127.0.0.1 -d /path/to/project

If Node.js tooling is required:

Pin exact reviewed versions rather than relying on the latest registry release.

Declare packages in a project manifest.

Commit and enforce a lockfile containing integrity metadata.

Install with a reproducible command such as npm ci.

Review the package publisher, source repository, release history, and transitive dependencies.

Avoid running package installation or preview commands with administrative privileges.

Use a restricted environment without sensitive credentials.

For example:

bash
npm install --save-dev --save-exact http-server@REVIEWED_VERSION npm ci ./node_modules/.bin/http-server -p 8080 -c-1 /path/to/project

REVIEWED_VERSION must be replaced with an exact version that has been independently reviewed and recorded in the lockfile.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/opencode-automation.sh:132
Finding: Archive Extraction Without Entry Path or Link Validation
Content: View full analysis
Vulnerability Details

File Location: scripts/opencode-automation.sh, lines 132–141
Vulnerability Type: Unsafe extraction of potentially untrusted archives
Risk Level: Medium

Vulnerable Code:

bash
# Function: extract files extract_archive() { local ARCHIVE_FILE="$1" local DESTINATION="${ARCHIVE_FILE%.tar.gz}" print_info "Extracting file..." print_info "Archive: $ARCHIVE_FILE" print_info "Destination directory: $DESTINATION" tar -xzf "$ARCHIVE_FILE" -C "$(dirname "$DESTINATION")" print_success "Extraction completed" }

Technical Analysis

The function passes an archive supplied through a command-line argument directly to tar without first validating its members. It does not reject absolute paths, parent-directory traversal components, device entries, or unsafe symbolic and hard links. It also extracts into the parent directory derived from the archive path rather than into a newly created, dedicated extraction directory.

Depending on the archive contents, permissions, and behavior of the installed tar implementation, malicious entries may escape the intended extraction boundary or use links to redirect writes. Some tar implementations provide partial traversal protections, but the script does not enforce a portable security policy and should not rely exclusively on implementation-specific defaults.

Attack Path

An attacker creates a .tar.gz archive containing traversal paths, absolute paths, or unsafe link entries.

The attacker convinces the user to process it with:

bash
./scripts/opencode-automation.sh extract attacker.tar.gz

The function calculates the destination from the untrusted archive filename and invokes tar without inspecting archive members.

If the local extraction behavior permits the crafted entry, files are written or linked outside the intended destination.

The attacker may overwrite ...[truncated 846 chars]
Remediation: View remediation
Remediation Suggestions

Implement validation and isolation before extracting an archive:

Resolve and validate the archive path.

Create a new private extraction directory with restrictive permissions.

List all archive members before extraction.

Reject absolute paths and entries containing .. path components.

Reject device files and other special entries.

Inspect and reject symbolic or hard links whose targets escape the destination.

Refuse to extract over an existing destination unless explicitly authorized.

Extract without preserving ownership or elevated permission metadata.

Run extraction with the least privileged account available.

A hardened design should follow this sequence:

bash
extract_archive() { local archive="$1" local destination="$2" mkdir -m 700 -- "$destination" if tar -tzf "$archive" | grep -Eq '(^/|(^|/)\.\.(/|$))'; then echo "Unsafe archive path detected" >&2 return 1 fi # Additional validation must reject unsafe links and special files. tar --no-same-owner --no-same-permissions \ -xzf "$archive" \ -C "$destination" }

The path check alone is not sufficient: link targets and special entry types must also be validated using archive metadata before extraction.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (39)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Even though this is not the catastrophic pattern suggested by the matcher text, 'rm -rf /tmp/*' is still a broadly destructive command that can remove files belonging to other applications, interfere with active processes, or cause local denial of service. In copy-paste documentation, providing it without safeguards or warnings increases the chance of accidental damage.
Content: Scanner excerpt · REFERENCES.md (reported line 467)May include surrounding context.
md
df -h # 清理临时文件 rm -rf /tmp/* # 清理 opencode 缓存 rm -rf ~/.local/share/opencode/cache/*

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Even though this is not the catastrophic pattern suggested by the matcher text, 'rm -rf /tmp/*' is still a broadly destructive command that can remove files belonging to other applications, interfere with active processes, or cause local denial of service. In copy-paste documentation, providing it without safeguards or warnings increases the chance of accidental damage.
Content: Scanner excerpt · REFERENCES.md (reported line 467)May include surrounding context.
md
df -h # 清理临时文件 rm -rf /tmp/* # 清理 opencode 缓存 rm -rf ~/.local/share/opencode/cache/*

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The cache-deletion command is narrower than generic recursive removal, but it still uses forceful recursive deletion with shell expansion and no validation. If the path is mistyped, unexpectedly symlinked, or copied into a different environment, users could delete unintended content.
Content: Scanner excerpt · REFERENCES.md (reported line 470)May include surrounding context.
rm -rf /tmp/*

清理 opencode 缓存

rm -rf ~/.local/share/opencode/cache/*

text
### 问题 5：内存不足

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The cache-deletion command is narrower than generic recursive removal, but it still uses forceful recursive deletion with shell expansion and no validation. If the path is mistyped, unexpectedly symlinked, or copied into a different environment, users could delete unintended content.
Content: Scanner excerpt · REFERENCES.md (reported line 470)May include surrounding context.
rm -rf /tmp/*

清理 opencode 缓存

rm -rf ~/.local/share/opencode/cache/*

text
### 问题 5：内存不足

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Deleting cache contents with a wildcard is a destructive operation that can remove more than intended if the target path is altered or if the script is run in an unexpected environment. While aimed at cleanup, the lack of guards, checks, and confirmation makes it a genuine safety issue.
Content: Scanner excerpt · scripts/opencode-automation.sh (reported line 220)May include surrounding context.
sh
print_info "清理临时文件..." # 清理 opencode 缓存 rm -rf ~/.local/share/opencode/cache/* # 清理临时目录 rm -rf /tmp/opencode_*

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Deleting cache contents with a wildcard is a destructive operation that can remove more than intended if the target path is altered or if the script is run in an unexpected environment. While aimed at cleanup, the lack of guards, checks, and confirmation makes it a genuine safety issue.
Content: Scanner excerpt · scripts/opencode-automation.sh (reported line 220)May include surrounding context.
sh
print_info "清理临时文件..." # 清理 opencode 缓存 rm -rf ~/.local/share/opencode/cache/* # 清理临时目录 rm -rf /tmp/opencode_*

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: rm -rf /tmp/opencode_* performs irreversible wildcard deletion in /tmp without verifying ownership or whether matching paths were created by this script/application. In shared or multi-user environments, this can delete unrelated files or follow unexpectedly broad matches, leading to denial of service or loss of temporary data.
Content: Scanner excerpt · scripts/opencode-automation.sh (reported line 223)May include surrounding context.
sh
rm -rf ~/.local/share/opencode/cache/* # 清理临时目录 rm -rf /tmp/opencode_* print_success "清理完成" }

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: rm -rf /tmp/opencode_* performs irreversible wildcard deletion in /tmp without verifying ownership or whether matching paths were created by this script/application. In shared or multi-user environments, this can delete unrelated files or follow unexpectedly broad matches, leading to denial of service or loss of temporary data.
Content: Scanner excerpt · scripts/opencode-automation.sh (reported line 223)May include surrounding context.
sh
rm -rf ~/.local/share/opencode/cache/* # 清理临时目录 rm -rf /tmp/opencode_* print_success "清理完成" }

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill activates on very broad phrases such as creating websites, analyzing projects, or running tasks, which overlap with many normal user requests. In an agent environment, this can cause the skill to be invoked unexpectedly and then expose powerful file, process, and command-execution guidance without clear user intent boundaries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README includes destructive or privileged operational guidance such as killing processes, changing permissions/ownership, and modifying firewall settings, but does not warn about risks, least-privilege use, or the need for confirmation. In a skill context, this can normalize unsafe remediation steps and lead an agent or user to make harmful system changes during routine troubleshooting.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 314)May include surrounding context.
md
ls -la /path/to/file # 修改文件权限 chmod 755 /path/to/directory chmod 644 /path/to/file # 修改文件所有者

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · REFERENCES.md (reported line 431)May include surrounding context.
md
ls -la /path/to/file # 修改文件权限 chmod 755 /path/to/directory chmod 644 /path/to/file # 修改文件所有者

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 315)May include surrounding context.
md
# 修改文件权限 chmod 755 /path/to/directory chmod 644 /path/to/file # 修改文件所有者 sudo chown -R $USER:$USER /path/to/directory

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · REFERENCES.md (reported line 432)May include surrounding context.
md
# 修改文件权限 chmod 755 /path/to/directory chmod 644 /path/to/file # 修改文件所有者 sudo chown -R $USER:$USER /path/to/directory

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The instruction to run sudo chown -R changes ownership recursively and requires elevated privileges. If applied to the wrong path, it can break system ownership, alter access control, or damage the host environment; in an agent skill, presenting this as routine troubleshooting increases the chance of unsafe execution.
Content: Scanner excerpt · README.md (reported line 318)May include surrounding context.
chmod 644 /path/to/file

修改文件所有者

sudo chown -R $USER:$USER /path/to/directory

text
#### 问题 3：网络连接问题

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The README suggests using sudo ufw status as part of troubleshooting, which introduces privileged execution into a general-purpose skill workflow. While status checks are less dangerous than changes, normalizing sudo-based steps can lead to unnecessary privilege use and train agents/users toward escalated operations.
Content: Scanner excerpt · README.md (reported line 331)May include surrounding context.
解决方案：

bash
# 检查防火墙 sudo ufw status # 允许 opencode 通过防火墙 sudo ufw allow 4096/tcp

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The command sudo ufw allow 4096/tcp modifies the system firewall and opens a listening port, requiring root privileges. In this skill, the server is otherwise shown as localhost-oriented, so opening the firewall may be unnecessary and could increase exposure if the service is later bound more broadly or misconfigured.
Content: Scanner excerpt · README.md (reported line 334)May include surrounding context.
md
sudo ufw status # 允许 opencode 通过防火墙 sudo ufw allow 4096/tcp # 检查路由 ping 127.0.0.1

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide presents starting the opencode web server without authentication as a standard step and does not clearly warn against use beyond isolated local testing. In an agent/server product, unauthenticated access can expose powerful functionality to other local users, LAN peers, or anyone reachable through misconfiguration.
Content: No source excerpt is available for this finding.

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · REFERENCES.md (reported line 233)May include surrounding context.
bash
# 列出文件 ls -la /home/linshui/.openclaw/workspace/linshui-tech/ # 查看文件大小 du -sh /home/linshui/.openclaw/workspace/linshui-tech/

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The documentation recommends invoking packages via npx without pinning a specific version, which means users may fetch whatever version is current at execution time. This creates supply-chain and reproducibility risk, especially for developer tooling that executes downloaded code immediately.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Using 'npx nodemon' without an exact version causes unpinned remote code execution from the package registry at runtime. If the package or one of its dependencies is compromised, users following the guide may execute attacker-controlled code.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · REFERENCES.md (reported line 435)May include surrounding context.
chmod 644 /path/to/file

修改文件所有者

sudo chown -R $USER:$USER /path/to/directory

text
### 问题 3：网络连接问题

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · REFERENCES.md (reported line 449)May include surrounding context.
chmod 644 /path/to/file

修改文件所有者

sudo chown -R $USER:$USER /path/to/directory

text
### 问题 3：网络连接问题

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The troubleshooting section recommends destructive deletion commands like 'rm -rf /tmp/*' and cache removal without any warning about data loss, symlink risks, or validating the target path. In a skill context, users may copy-paste these commands blindly, leading to accidental deletion of important files or disruption of running processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advertises file management and task execution capabilities, including creating, copying, moving, and deleting files, without pairing those capabilities with explicit warnings, confirmation requirements, or safety constraints. In context, this makes accidental destructive operations more likely because users may treat the skill as routine assistance while it exposes high-impact filesystem actions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

清理 opencode 缓存

Tool Parameter Abuse

清理 opencode 缓存

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Vague Triggers

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

修改文件所有者

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

File System Enumeration

Rp1

Rp1

Sudo/Root Execution

修改文件所有者

Sudo/Root Execution

修改文件所有者

Missing User Warnings

Missing User Warnings

Static analysis