OpenCode Session Toolkit

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 2.0.0

Overview

The skill is mostly coherent and read-only against the OpenCode database, but it can be invoked implicitly to read and bulk-export sensitive local session transcripts.

Install only if you are comfortable with an agent reading your local OpenCode session history. Use it for explicit session tasks, avoid --include-sensitive unless you need raw payloads, choose export directories carefully, and review outputs because exported files may contain prompts, code, tool output, paths, or accidental secrets.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: scripts/opencode_sessions.py:1063

Finding

Implicitly Invocable Skill Can Read and Bulk-Export Sensitive Local Session Transcripts

Content

View full analysis

list[MessageRecord]: require_capability(capabilities, "message") require_capability(capabilities, "part") message_rows = connection.execute( """ SELECT id, time_created, data FROM message WHERE session_id = ? ORDER BY time_created ASC, id ASC """, (session_id,), ).fetchall() messages: list[MessageRecord] = [] by_id: dict[str, MessageRecord] = {} for row in message_rows: raw = str(row["data"]) payload = safe_json_loads(raw) message = MessageRecord( id=str(row["id"]), created_ms=int(row["time_created"]), role=str((payload or {}).get("role") or "unknown"), model_id=string_or_none((payload or {}).get("modelID")), provider_id=string_or_none((payload or {}).get("providerID")), payload=payload, raw_data=raw, ) messages.append(message) by_id[message.id] = message for row in connection.execute( """ SELECT id, message_id, time_created, data FROM part WHERE session_id = ? ORDER BY message_id ASC, time_created ASC, id ASC """, (session_id,), ): message = by_id.get(str(row["message_id"])) if message is None: continue raw = str(row["data"]) payload = safe_json_loads(raw) message.parts.append( PartRecord( id=str(row["id"]), created_ms=int(row["ti ...[truncated 5754 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/cli.md (reported line 96)May include surrounding context.

md

`--include-sensitive` applies the same opt-in boundary as `show` and emits a warning on stderr.

## Output rules

- Displayed times are UTC ISO-8601.
- Naive datetimes and date-only bounds are interpreted in the machine's local timezone.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes a local CLI via shell and references loading additional local files, but it does not declare any tool restrictions such as permissions or allowed-tools. Without explicit scope, an agent may have broader shell or file-read access than intended, increasing the chance of unintended command execution or access to sensitive local data beyond the session database.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill enables implicit invocation without any visible trigger constraints, allowing it to activate in broader conversational contexts than intended. Because this skill can inspect, search, and export local OpenCode SQLite session data across projects, ambiguous activation increases the risk of unintended access to sensitive transcripts or archives when a user did not explicitly request this tool.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/opencode_sessions.py (reported line 268)May include surrounding context.

python

path = Path(explicit_path).expanduser().resolve()
    else:
        try:
            result = subprocess.run(
                ["opencode", "db", "path"],
                check=True,
                capture_output=True,

Static analysis

No suspicious patterns detected.