opencode

Fail

Audited by Snyk on Apr 21, 2026

Risk Level: CRITICAL
Full Analysis

CRITICAL E006: Malicious code pattern detected in skill scripts.

  • Malicious code pattern detected (high risk: 0.85). This skill intentionally instructs use of auto-approve flags and permissive environment/config settings (e.g., --dangerously-skip-permissions, OPENCODE_DANGEROUSLY_SKIP_PERMISSIONS, OPENCODE_CONFIG_CONTENT='{"permission":{"*":"allow"}}'), plus agent modes that grant filesystem and shell access and a persistent server mode — behaviors that enable headless remote code execution, unattended file modifications, and could be abused for backdoors or data exfiltration.

Issues (1)

E006
CRITICAL

Malicious code pattern detected in skill scripts.

Audit Metadata
Risk Level
CRITICAL
Analyzed
Apr 21, 2026, 12:58 PM
Issues
1
Security Audit — snyk — opencode