Oh My OpenCode

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 4:12 AM UTC
• Version: 1.0.0

Overview

This is a coherent OpenCode orchestration skill, but it documents powerful autonomous coding workflows and install commands that users should run deliberately.

Install only if you trust oh-my-opencode, OpenCode, and the upstream package sources. Prefer package-manager or verified installs over curl-to-bash, keep command/file permissions on ask or deny for risky actions, run on a clean git branch or worktree, review generated plans and diffs, monitor model/API cost, and stop background or continuation workflows when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill clearly instructs users to run shell commands (`curl ... | bash`, `bunx`, `opencode`, `tmux`) but does not declare permissions or otherwise scope that capability. In an agent ecosystem, undeclared execution capability increases the chance that a user or orchestrator invokes the skill without understanding it can drive command execution and system changes.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The description is extremely broad: it covers installation, configuration, operation, troubleshooting, hooks, skills, MCPs, and 'any oh-my-opencode feature,' which could cause the skill to activate for many ordinary OpenCode-related requests. Overbroad activation raises prompt-squatting risk by allowing this skill to intercept tasks outside a narrowly intended scope and steer users toward its own workflows and commands.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill recommends a curl-to-shell installation command (`curl -fsSL https://opencode.ai/install | bash`) without any integrity verification, pinning, or warning. This is dangerous because it executes remote code immediately in the user's shell, so a compromised server, DNS/TLS interception, or maliciously changed installer could lead to arbitrary code execution on the host.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation states that the default browser automation provider is auto-installed via `npx`, which can cause users to execute third-party code from the network without an explicit security warning or trust boundary explanation. In a multi-agent orchestration plugin, this is more dangerous because users may enable automation features expecting only configuration changes, while the tooling path silently introduces code execution and supply-chain risk.

External Script Fetching

High

• Category: Supply Chain

Content

pass "OpenCode installed: $OC_VERSION"
else
    fail "OpenCode is not installed"
    echo "  Install: curl -fsSL https://opencode.ai/install | bash"
    echo "  Or: npm install -g opencode-ai"
    exit 1
fi

• Confidence: 93% confidence
• Finding: curl -fsSL https://opencode.ai/install | bash

External Script Fetching

High

• Category: Supply Chain

Content

warn "bunx not found, npx available (bunx is recommended)"
else
    fail "Neither bunx nor npx found"
    echo "  Install Bun: curl -fsSL https://bun.sh/install | bash"
fi

# Check 3: Plugin registration

• Confidence: 93% confidence
• Finding: curl -fsSL https://bun.sh/install | bash

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.