opencode-skills-collection@4.1.31

Summary

Package bundles a collection of skill directories containing various helper scripts. Static pattern matches fired on routine network primitives: a Python scraper (bundled-skills/junta-leiloeiros/scripts/base_scraper.py) and an API server script (serve_api.py) that reference ping/GET/POST, a benchmark harness (bundled-skills/loki-mode/benchmarks/run-benchmarks.sh), an rclone install helper (bundled-skills/rclone-cli/scripts/install.sh) that runs curl https://rclone.org to fetch the rclone installer from its official project domain, and a youtube-notetaker verification script using curl against GET endpoints. Matches reflect keyword co-occurrence (curl/ping/GET/POST) in utility scripts rather than exfiltration shapes: no hardcoded attacker C2, no reads of installer-side secret paths (~/.aws, ~/.ssh, ~/.npmrc), no environment scraping, no obfuscated destinations, and no install-time lifecycle hook that auto-executes these scripts. The rclone install.sh fetches from rclone's official domain, which is aggressive-but-legitimate runtime tool installation rather than a dropper. The scripts fire only when a user explicitly invokes the corresponding skill, not on npm install.

Source: amazon-inspector (ad4663af5b87079e1a7cdbfd6f3626801e542f7fdfe79316dec31974dd625941)