opencode-api

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit plaintext credentials (e.g., "user admin password admin") and templates that instruct embedding them verbatim in messages/commands sent via the API, requiring the LLM to handle and output secret values.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document defines a REST-accessible remote shell with full filesystem, process, user and network control (including sudo), explicit examples for sending credentials and base64-encoded payloads, and endpoints/permissions that enable command-and-control, credential theft, data exfiltration, and persistent compromise—effectively a backdoor/remote code execution service with high abuse potential.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill requires and uses the OpenCode AI Server REST API endpoints at runtime (e.g., http://<IP_ADDRESS>:9899 — including listed hosts http://127.0.0.1:9899, http://44.197.31.152:9899, http://52.3.242.251:9899) to execute shell commands and send AI-assisted messages, which directly causes remote code execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly grants and instructs full remote shell execution with sudo privileges, file system and system configuration modification, and user account management (including creation), which directly enables compromising or altering the host machine state.