Oh My OpenCode

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:08 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate OpenCode orchestration skill, but it asks users to enable broad autonomous agent behavior and includes risky unpinned or remote-code installation paths.

Review this before installing. Use pinned package versions where possible, avoid piping remote installers directly into a shell, run diagnostics only when you are comfortable executing registry-hosted code, and keep autonomous/background hooks disabled or approval-gated for repositories containing secrets or sensitive business code.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:26

Finding

Unverified Remote Installer Executed Through curl-to-shell Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:23-29, with the same unsafe installation pattern repeated in scripts/doctor.sh:23-28, scripts/doctor.sh:36-41, and scripts/run-ulw.sh:46-50
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

SKILL.md:23-29:

bash

1. **OpenCode** installed and configured (`opencode --version` should be 1.0.150+)
   ```bash
   curl -fsSL https://opencode.ai/install | bash
   # or: npm install -g opencode-ai
   # or: bun install -g opencode-ai
   ```

scripts/doctor.sh:23-28:

bash

else
    fail "OpenCode is not installed"
    echo "  Install: curl -fsSL https://opencode.ai/install | bash"
    echo "  Or: npm install -g opencode-ai"
    exit 1
fi

scripts/doctor.sh:36-41:

bash

elif command -v npx &>/dev/null; then
    warn "bunx not found, npx available (bunx is recommended)"
else
    fail "Neither bunx nor npx found"
    echo "  Install Bun: curl -fsSL https://bun.sh/install | bash"
fi

scripts/run-ulw.sh:46-50:

bash

if ! command -v opencode &>/dev/null; then
    echo "Error: opencode is not installed"
    echo "Install: curl -fsSL https://opencode.ai/install | bash"
    exit 1
fi

Technical Analysis

The primary prerequisite instructions tell the user or executing Agent to download an installer from a mutable external URL and pipe the response directly into Bash. This combines retrieval and execution without an opportunity to inspect the content and without validating a cryptographic signature, checksum, immutable release version, or expected file identity.

Although the shell scripts only print this command rather than executing it themselves, installation instructions are operational Skill behavior: an Agent using the Skill may present or follow them. The effective code executed by the user can therefore change after this Skil ...[truncated 1712 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all curl ... | bash recommendations from the Skill and scripts.
2. Pin installation instructions to an immutable, audited release version rather than a mutable installer endpoint.
3. Download the artifact to a local file before execution:

   bash

   curl --fail --show-error --location \
     --output opencode-installer.sh \
     https://trusted.example/releases/vX.Y.Z/install.sh
   

4. Publish and verify a SHA-256 or stronger digest obtained through an independently protected release channel:

   bash

   echo "EXPECTED_SHA256  opencode-installer.sh" | sha256sum --check -
   

5. Prefer signed release artifacts and verify the signature against a pinned maintainer key.
6. Allow the user to inspect the downloaded script before execution.
7. Require explicit confirmation before executing any downloaded code.
8. Document that installers must not be run as root unless system-wide installation is strictly necessary.
9. Update doctor.sh and run-ulw.sh to link to verified manual installation documentation instead of printing executable curl-to-shell commands.

T08 · Insecure Dependencies

Warning

• Location: scripts/doctor.sh:103

Finding

Automatic Execution of Unpinned Registry Packages

Content

View full analysis

Vulnerability Details

File Location: scripts/doctor.sh:103-128, with unpinned execution also instructed in SKILL.md:16, SKILL.md:38-49, SKILL.md:363-366, references/configuration.md:257, and references/troubleshooting.md:47,350,355,381
Vulnerability Type: Insecure third-party dependency execution
Risk Level: Medium

Vulnerable Code

scripts/doctor.sh:103-128:

bash

# Check 7: Try running oh-my-opencode doctor
echo ""
echo "Running oh-my-opencode built-in doctor..."
echo ""

if command -v bunx &>/dev/null; then
    if [ "$VERBOSE" = "--verbose" ]; then
        bunx oh-my-opencode doctor --verbose 2>/dev/null || {
            warn "bunx oh-my-opencode doctor failed — falling back to manual checks above"
        }
    else
        bunx oh-my-opencode doctor 2>/dev/null || {
            warn "bunx oh-my-opencode doctor failed — falling back to manual checks above"
        }
    fi
elif command -v npx &>/dev/null; then
    if [ "$VERBOSE" = "--verbose" ]; then
        npx oh-my-opencode doctor --verbose 2>/dev/null || {
            warn "npx oh-my-opencode doctor failed — falling back to manual checks above"
        }
    else
        npx oh-my-opencode doctor 2>/dev/null || {
            warn "npx oh-my-opencode doctor failed — falling back to manual checks above"
        }
    fi
else
    warn "Cannot run oh-my-opencode doctor (no bunx or npx)"
fi

SKILL.md:38-49:

bash

Run the interactive installer:

```bash
bunx oh-my-opencode install

Non-interactive mode with provider flags:

bash

bunx oh-my-opencode install --no-tui \
  --claude=<yes|no|max20> \
  --openai=<yes|no>

text

### Technical Analysis

The commands identify `oh-my-opencode` by package name without an exact version or verified integrity value. Package runners such as `bunx` and `npx` can resolve and execute registr
...[truncated 2427 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a specifically reviewed version in every command:

   bash

   bunx oh-my-opencode@X.Y.Z doctor
   bunx oh-my-opencode@X.Y.Z install
   

2. Use a lockfile and package-manager integrity metadata where a local project installation is practical.
3. Record and verify the expected package digest or provenance attestation before execution.
4. Separate local diagnosis from external package execution. Make doctor.sh perform only its existing local checks by default.
5. Place external package execution behind an explicit option such as --run-upstream-doctor and request user confirmation before downloading anything.
6. Detect whether a trusted, already installed executable is available and prefer it over registry resolution.
7. Remove the automatic npx fallback unless its package version and integrity can be enforced equivalently.
8. Do not suppress all standard error. Preserve package-manager security and integrity warnings, or filter only specifically understood noise.
9. Document the package source, exact supported version, expected publisher identity, and verification procedure.
10. Regularly review pinned versions and update them through a controlled dependency-review process rather than resolving the latest package at runtime.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (19)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill recommends installing software via a remote script piped directly from a URL. This is dangerous because any compromise of the remote host, transport path, or script content results in immediate arbitrary code execution on the user's machine, and the orchestration-focused nature of the skill makes shell use especially likely.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

1. OpenCode installed and configured (opencode --version should be 1.0.150+)

   bash

   curl -fsSL https://opencode.ai/install | bash
   # or: npm install -g opencode-ai
   # or: bun install -g opencode-ai
   

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping fetched content directly into bash is a classic command-chaining antipattern that eliminates opportunities to inspect or verify what will run. In this skill, which already promotes automation and shell-driven setup, the pattern materially increases the risk of silent arbitrary command execution during installation.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

1. OpenCode installed and configured (opencode --version should be 1.0.150+)

   bash

   curl -fsSL https://opencode.ai/install | bash
   # or: npm install -g opencode-ai
   # or: bun install -g opencode-ai
   

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The script recommends 'curl -fsSL https://opencode.ai/install | bash', a classic pipe-to-shell pattern that executes remote code immediately without prior verification. If the remote host, network path, or fetched installer is compromised, users may execute arbitrary commands on their machine.

Content

Scanner excerpt · scripts/doctor.sh (reported line 27)May include surrounding context.

sh

pass "OpenCode installed: $OC_VERSION"
else
    fail "OpenCode is not installed"
    echo "  Install: curl -fsSL https://opencode.ai/install | bash"
    echo "  Or: npm install -g opencode-ai"
    exit 1
fi

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

This line recommends 'curl -fsSL https://bun.sh/install | bash', which encourages direct execution of remote script content. Even as printed guidance rather than immediate execution, it normalizes an unsafe installation pattern and can lead to arbitrary code execution if the fetched script is malicious or tampered with.

Content

Scanner excerpt · scripts/doctor.sh (reported line 40)May include surrounding context.

sh

warn "bunx not found, npx available (bunx is recommended)"
else
    fail "Neither bunx nor npx found"
    echo "  Install Bun: curl -fsSL https://bun.sh/install | bash"
fi

# Check 3: Plugin registration

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/run-ulw.sh (reported line 49)May include surrounding context.

sh

# Verify opencode is installed
if ! command -v opencode &>/dev/null; then
    echo "Error: opencode is not installed"
    echo "Install: curl -fsSL https://opencode.ai/install | bash"
    exit 1
fi

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents and encourages shell execution, package installation, server startup, and tmux-based orchestration, but it declares no explicit tool scope or allowed-tools boundary. In an agent setting this increases the chance that a caller enables shell access implicitly and the skill performs impactful local actions without clear least-privilege constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill says to trigger autonomous work merely by including broad natural-language keywords like 'ultrawork' or 'ulw' in a prompt. This creates ambiguous activation conditions that can be invoked unintentionally or through prompt injection in surrounding content, leading to autonomous codebase actions without deliberate user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill describes autonomous behavior that explores the codebase, researches, implements changes, verifies them, and 'keeps working until 100% complete' without a corresponding safety warning about limited review or possible unintended modifications. That framing can encourage unsupervised operation and reduce opportunities for human approval before impactful actions occur.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented 'keyword-detector' hook automatically detects terms like 'ultrawork' and 'ulw' without defining scope, source trust, or exclusions. In a multi-agent environment, such hooks can be triggered by quoted text, repository content, or adversarial instructions, causing mode switches and follow-on actions the user did not intend.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 77)May include surrounding context.

Verify Ollama is running:

bash

curl http://localhost:11434/api/tags

Test with curl:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/troubleshooting.md (reported line 254)May include surrounding context.

md

## Background Agents Not Spawning

**Symptom**: `delegate_task(run_in_background=true)` doesn't create background tasks, or tasks stall.

**Causes**:
- Concurrency limits reached

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The script executes 'npx oh-my-opencode doctor --verbose' without pinning a version. That can pull and run the latest package code from the registry at execution time, creating a supply-chain risk if the package is compromised, typo-squatted, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The script executes 'npx oh-my-opencode doctor' without a pinned version. Running packages directly from the registry at latest version introduces supply-chain execution risk and reduces reproducibility.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 20)May include surrounding context.

bash

# Docker: always use -it flags
docker run -it --rm ghcr.io/anomalyco/opencode

---