Oh My OpenCode

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:08 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate OpenCode orchestration skill, but it asks users to enable broad autonomous agent behavior and includes risky unpinned or remote-code installation paths.

Review this before installing. Use pinned package versions where possible, avoid piping remote installers directly into a shell, run diagnostics only when you are comfortable executing registry-hosted code, and keep autonomous/background hooks disabled or approval-gated for repositories containing secrets or sensitive business code.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:26
• Finding: Unverified Remote Installer Executed Through curl-to-shell Instructions## Vulnerability Details **File Location**: `SKILL.md:23-29`, with the same unsafe installation pattern repeated in `scripts/doctor.sh:23-28`, `scripts/doctor.sh:36-41`, and `scripts/run-ulw.sh:46-50` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code `SKILL.md:23-29`: ```bash 1. **OpenCode** installed and configured (`opencode --version` should be 1.0.150+) ```bash curl -fsSL https://opencode.ai/install | bash # or: npm install -g opencode-ai # or: bun install -g opencode-ai ``` ``` `scripts/doctor.sh:23-28`: ```bash else fail "OpenCode is not installed" echo " Install: curl -fsSL https://opencode.ai/install | bash" echo " Or: npm install -g opencode-ai" exit 1 fi ``` `scripts/doctor.sh:36-41`: ```bash elif command -v npx &>/dev/null; then warn "bunx not found, npx available (bunx is recommended)" else fail "Neither bunx nor npx found" echo " Install Bun: curl -fsSL https://bun.sh/install | bash" fi ``` `scripts/run-ulw.sh:46-50`: ```bash if ! command -v opencode &>/dev/null; then echo "Error: opencode is not installed" echo "Install: curl -fsSL https://opencode.ai/install | bash" exit 1 fi ``` ### Technical Analysis The primary prerequisite instructions tell the user or executing Agent to download an installer from a mutable external URL and pipe the response directly into Bash. This combines retrieval and execution without an opportunity to inspect the content and without validating a cryptographic signature, checksum, immutable release version, or expected file identity. Although the shell scripts only print this command rather than executing it themselves, installation instructions are operational Skill behavior: an Agent using the Skill may present or follow them. The effective code executed by the user can therefore change after this Skil ...[truncated 1712 chars]
• Remediation: ## Remediation Suggestions 1. Remove all `curl ... | bash` recommendations from the Skill and scripts. 2. Pin installation instructions to an immutable, audited release version rather than a mutable installer endpoint. 3. Download the artifact to a local file before execution: ```bash curl --fail --show-error --location \ --output opencode-installer.sh \ https://trusted.example/releases/vX.Y.Z/install.sh ``` 4. Publish and verify a SHA-256 or stronger digest obtained through an independently protected release channel: ```bash echo "EXPECTED_SHA256 opencode-installer.sh" | sha256sum --check - ``` 5. Prefer signed release artifacts and verify the signature against a pinned maintainer key. 6. Allow the user to inspect the downloaded script before execution. 7. Require explicit confirmation before executing any downloaded code. 8. Document that installers must not be run as root unless system-wide installation is strictly necessary. 9. Update `doctor.sh` and `run-ulw.sh` to link to verified manual installation documentation instead of printing executable curl-to-shell commands.

T08 · Insecure Dependencies

Warning

• Location: scripts/doctor.sh:103
• Finding: Automatic Execution of Unpinned Registry Packages## Vulnerability Details **File Location**: `scripts/doctor.sh:103-128`, with unpinned execution also instructed in `SKILL.md:16`, `SKILL.md:38-49`, `SKILL.md:363-366`, `references/configuration.md:257`, and `references/troubleshooting.md:47,350,355,381` **Vulnerability Type**: Insecure third-party dependency execution **Risk Level**: Medium ### Vulnerable Code `scripts/doctor.sh:103-128`: ```bash # Check 7: Try running oh-my-opencode doctor echo "" echo "Running oh-my-opencode built-in doctor..." echo "" if command -v bunx &>/dev/null; then if [ "$VERBOSE" = "--verbose" ]; then bunx oh-my-opencode doctor --verbose 2>/dev/null || { warn "bunx oh-my-opencode doctor failed — falling back to manual checks above" } else bunx oh-my-opencode doctor 2>/dev/null || { warn "bunx oh-my-opencode doctor failed — falling back to manual checks above" } fi elif command -v npx &>/dev/null; then if [ "$VERBOSE" = "--verbose" ]; then npx oh-my-opencode doctor --verbose 2>/dev/null || { warn "npx oh-my-opencode doctor failed — falling back to manual checks above" } else npx oh-my-opencode doctor 2>/dev/null || { warn "npx oh-my-opencode doctor failed — falling back to manual checks above" } fi else warn "Cannot run oh-my-opencode doctor (no bunx or npx)" fi ``` `SKILL.md:38-49`: ```bash Run the interactive installer: ```bash bunx oh-my-opencode install ``` Non-interactive mode with provider flags: ```bash bunx oh-my-opencode install --no-tui \ --claude=<yes|no|max20> \ --openai=<yes|no> ``` ``` ### Technical Analysis The commands identify `oh-my-opencode` by package name without an exact version or verified integrity value. Package runners such as `bunx` and `npx` can resolve and execute registr ...[truncated 2427 chars]
• Remediation: ## Remediation Suggestions 1. Pin the package to a specifically reviewed version in every command: ```bash bunx oh-my-opencode@X.Y.Z doctor bunx oh-my-opencode@X.Y.Z install ``` 2. Use a lockfile and package-manager integrity metadata where a local project installation is practical. 3. Record and verify the expected package digest or provenance attestation before execution. 4. Separate local diagnosis from external package execution. Make `doctor.sh` perform only its existing local checks by default. 5. Place external package execution behind an explicit option such as `--run-upstream-doctor` and request user confirmation before downloading anything. 6. Detect whether a trusted, already installed executable is available and prefer it over registry resolution. 7. Remove the automatic `npx` fallback unless its package version and integrity can be enforced equivalently. 8. Do not suppress all standard error. Preserve package-manager security and integrity warnings, or filter only specifically understood noise. 9. Document the package source, exact supported version, expected publisher identity, and verification procedure. 10. Regularly review pinned versions and update them through a controlled dependency-review process rather than resolving the latest package at runtime.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (19)

External Script Fetching

High

• Category: Supply Chain

Content

1. **OpenCode** installed and configured (`opencode --version` should be 1.0.150+)
   ```bash
   curl -fsSL https://opencode.ai/install | bash
   # or: npm install -g opencode-ai
   # or: bun install -g opencode-ai
   ```

• Confidence: 98% confidence
• Finding: The skill recommends installing software via a remote script piped directly from a URL. This is dangerous because any compromise of the remote host, transport path, or script content results in immediate arbitrary code execution on the user's machine, and the orchestration-focused nature of the skill makes shell use especially likely.

Chaining Abuse

High

• Category: Tool Misuse

Content

1. **OpenCode** installed and configured (`opencode --version` should be 1.0.150+)
   ```bash
   curl -fsSL https://opencode.ai/install | bash
   # or: npm install -g opencode-ai
   # or: bun install -g opencode-ai
   ```

• Confidence: 98% confidence
• Finding: Piping fetched content directly into bash is a classic command-chaining antipattern that eliminates opportunities to inspect or verify what will run. In this skill, which already promotes automation and shell-driven setup, the pattern materially increases the risk of silent arbitrary command execution during installation.

External Script Fetching

High

• Category: Supply Chain

Content

pass "OpenCode installed: $OC_VERSION"
else
    fail "OpenCode is not installed"
    echo "  Install: curl -fsSL https://opencode.ai/install | bash"
    echo "  Or: npm install -g opencode-ai"
    exit 1
fi

• Confidence: 95% confidence
• Finding: The script recommends 'curl -fsSL https://opencode.ai/install | bash', a classic pipe-to-shell pattern that executes remote code immediately without prior verification. If the remote host, network path, or fetched installer is compromised, users may execute arbitrary commands on their machine.

External Script Fetching

High

• Category: Supply Chain

Content

warn "bunx not found, npx available (bunx is recommended)"
else
    fail "Neither bunx nor npx found"
    echo "  Install Bun: curl -fsSL https://bun.sh/install | bash"
fi

# Check 3: Plugin registration

• Confidence: 95% confidence
• Finding: This line recommends 'curl -fsSL https://bun.sh/install | bash', which encourages direct execution of remote script content. Even as printed guidance rather than immediate execution, it normalizes an unsafe installation pattern and can lead to arbitrary code execution if the fetched script is malicious or tampered with.

External Script Fetching

High

• Category: Supply Chain

Content

# Verify opencode is installed
if ! command -v opencode &>/dev/null; then
    echo "Error: opencode is not installed"
    echo "Install: curl -fsSL https://opencode.ai/install | bash"
    exit 1
fi

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents and encourages shell execution, package installation, server startup, and tmux-based orchestration, but it declares no explicit tool scope or allowed-tools boundary. In an agent setting this increases the chance that a caller enables shell access implicitly and the skill performs impactful local actions without clear least-privilege constraints.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill says to trigger autonomous work merely by including broad natural-language keywords like 'ultrawork' or 'ulw' in a prompt. This creates ambiguous activation conditions that can be invoked unintentionally or through prompt injection in surrounding content, leading to autonomous codebase actions without deliberate user consent.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill describes autonomous behavior that explores the codebase, researches, implements changes, verifies them, and 'keeps working until 100% complete' without a corresponding safety warning about limited review or possible unintended modifications. That framing can encourage unsupervised operation and reduce opportunities for human approval before impactful actions occur.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The documented 'keyword-detector' hook automatically detects terms like 'ultrawork' and 'ulw' without defining scope, source trust, or exclusions. In a multi-agent environment, such hooks can be triggered by quoted text, repository content, or adversarial instructions, causing mode switches and follow-on actions the user did not intend.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Verify Ollama is running**:

```bash
curl http://localhost:11434/api/tags
```

**Test with curl**:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Background Agents Not Spawning

**Symptom**: `delegate_task(run_in_background=true)` doesn't create background tasks, or tasks stall.

**Causes**:
- Concurrency limits reached

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The script executes 'npx oh-my-opencode doctor --verbose' without pinning a version. That can pull and run the latest package code from the registry at execution time, creating a supply-chain risk if the package is compromised, typo-squatted, or unexpectedly changed.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The script executes 'npx oh-my-opencode doctor' without a pinned version. Running packages directly from the registry at latest version introduces supply-chain execution risk and reduces reproducibility.

Tool Parameter Abuse

Low

• Category: Tool Misuse

Content

```bash
# Docker: always use -it flags
docker run -it --rm ghcr.io/anomalyco/opencode
```

---

• Confidence: 15% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

No suspicious patterns detected.