Security audit

Opencode Cli

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but its setup guidance includes risky global package installs and plaintext service-key configuration that users should review before installing.

Install only if you are comfortable reviewing and controlling the OpenCode and MCP setup yourself. Avoid unpinned global npm installs, verify MCP package names and publishers, prefer project-local or sandboxed execution, keep API keys out of committed or shared config, and use Supabase database tools only against backed-up or non-production projects unless you explicitly intend schema or data changes.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: references/mcp-config-guide.md:38
Finding: Unverified and Unpinned Global npm Dependencies
Content: View full analysis
# 2. Install globally npm install -g # 3. Configure with binary name "command": [""] ``` ```bash npm install -g playwright-mcp-server ``` ```bash npm install -g context7-mcp ``` ```bash npm install -g mcp-server-supabase ``` ### Technical Analysis The guide recommends searching npm for a current package name and then installing that package globally without specifying a reviewed version, integrity hash, trusted publisher, lockfile, or reproducible installation mechanism. Running `npm view` only displays registry metadata. It does not authenticate the package publisher, inspect package contents, verify lifecycle scripts, or establish that the selected package is the official implementation. The instruction to “search npm for current package name” further exposes users to typosquatting, dependency confusion, abandoned package takeover, and selection of similarly named malicious packages. An npm package may execute lifecycle hooks such as `preinstall`, `install`, and `postinstall` during installation. A malicious or compromised package can therefore run arbitrary commands immediately, before its configured MCP binary is invoked. Installing globally also places executable files in a shared command search path, increasing the package’s reach beyond a single project. This guidance also conflicts with the security statement in `SKILL.md` that the Skill does not install or modify system-wide packages. ### Attack Path 1. An attacker publishes a package with a name resembling one of the suggested MCP packages, or compromises an existing package or publisher account. 2. A user follows the instruction to search npm for the cu ...[truncated 1395 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/mcp-config-guide.md:89
Finding: API Keys Stored Directly in Plaintext OpenCode Configuration
Content: View full analysis
", "DEFAULT_MINIMUM_TOKENS": "10000" } } } } ``` The complete configuration example similarly instructs users to place an API key directly in the global OpenCode configuration: ```json "context7": { "type": "local", "command": ["context7-mcp"], "environment": { "CONTEXT7_API_KEY": "" } } ``` ### Technical Analysis The guide directs users to insert the Context7 API key into `~/.config/opencode/opencode.json`. This stores the credential as plaintext in a persistent configuration file. No guidance is provided for restrictive file permissions, secret-manager integration, environment-variable inheritance, credential rotation, backup exclusion, or preventing the configuration from being included in diagnostic archives. Although the example uses a placeholder, its documented substitution point explicitly encourages replacement with a live credential. Any process or local account capable of reading the configuration file can recover the key. The credential may also be exposed through home-directory backups, support bundles, filesystem snapshots, configuration synchronization, terminal demonstrations, or accidental publication. ### Attack Path 1. A user replaces `` with a live Context7 API key. 2. The key is persistently stored in plaintext in the global OpenCode configuration. 3. An attacker gains read access through another process running as the user, overly broad file permissions, a compromised development tool, a backup, a diagnostic archive, or accidental file sharing. 4. The attacker extracts the API key from t ...[truncated 885 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
**What this skill does NOT do:** - Install or modify system-wide packages - Access credentials outside configured MCP servers - Persist beyond user-initiated sessions **Credential access:**

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file describes tools that can overwrite files, execute shell commands, and fetch web content, but it does not include any user-facing warning about risks such as destructive file changes, command side effects, or privacy implications of network access. Under the markdown-specific SQP-2 criteria, descriptions of behaviors affecting user data, privacy, or system integrity should disclose those risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file describes Supabase tools that can perform schema migrations and execute SQL queries, including creating or modifying tables, which can affect or destroy project data. Although the section states the tool purpose, it does not explicitly warn users about the risk of destructive or irreversible database changes before use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file includes opencode session delete <id>, which can irreversibly remove session state, but the surrounding documentation does not explicitly warn users that deletion is destructive. Although the skill generally discusses security scope, it does not disclose the irreversible nature of this specific command where it is introduced.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
## MCP Integration OpenCode supports MCP integration to extend capabilities. Must run in project root directory. **Common tools:** Playwright (UI automation), Supabase (database)

Static analysis

No suspicious patterns detected.