ocx-use
Fail
Audited by Snyk on Feb 16, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E005: Suspicious download URL detected in skill instructions.
- Suspicious download URL detected (high risk: 0.90). The prompt instructs running a direct shell script from https://ocx.kdco.dev/install.sh (curl | sh) and points to non-well-known registries (kdco.dev and a generic registry.company.com) with no evident trust signals, making these links a high-risk vector for distributing malware.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly installs and manages components from public registries and npm (e.g., "ocx add npm:@franlol/opencode-md-table-formatter", "ocx registry add https://registry.kdco.dev") and uses Ghost Mode to pull packages from arbitrary registries, meaning the agent will fetch and inspect untrusted, user-published third-party content as part of its workflow.
Audit Metadata