oh-my-opencode

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Several URLs point to an unknown third‑party GitHub repo (code-yeongyu) including raw .sh install scripts and curl|bash install patterns — a high-risk vector for malware distribution — while the official opencode.ai and nvm links are lower risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes explicit runtime fetch-and-execute and LLM-fetch patterns (curl | bash and curl into model input) such as https://opencode.ai/install and https://raw.githubusercontent.com/code-yeongyu/oh-my-opencode/refs/heads/master/docs/guide/installation.md which are fetched/executed at runtime and can directly control prompts or execute remote code.