Rules / CFG114

CFG114 committed agent plugin or extension code runs from the repository

Severity: error (OpenCode plugin or tool) · info (Copilot CLI project extension) OWASP: LLM04:2026 – Supply Chain

What cfgaudit checks

Every JavaScript or TypeScript file in .opencode/plugin/, .opencode/plugins/, .opencode/tool/ or .opencode/tools/ (one level deep, *.ts and *.js, as OpenCode globs them).

OpenCode imports these files from the repository itself. Measured with opencode 1.18.18 and a scratch HOME, each file writing a marker when imported:

file	runs
`.opencode/plugin/x.ts`, `.opencode/plugin/x.js`, `.opencode/plugins/x.ts`, `.opencode/plugins/x.js`	during a bare `opencode debug config`, before any session
`.opencode/tool/x.ts`, `.opencode/tool/x.js`, `.opencode/tools/x.ts`, `.opencode/tools/x.js`	during `opencode debug agent <name>`, as soon as an agent loads
control: the same plugin under `notopencode/plugin/`	never

No run asked anything. OpenCode has no workspace trust step, so opening a clone with OpenCode is enough to run the code with the user's own permissions.

Copilot CLI project extensions

Copilot CLI runs .github/extensions/<name>/extension.mjs (or .cjs / .js) with Node.js, from the project as from ~/.copilot/extensions/ (#648). GitHub's docs: "Extensions execute on your computer with your privileges". Two gates stand in front of a project extension, read from the 1.0.95 bundle and the docs: extensions are an experimental feature (--experimental or /experimental on), and project extensions load only once the folder is trusted (in -p mode only with GITHUB_COPILOT_PROMPT_MODE_EXTENSIONS=true). That is why the finding is info: the code is committed and runs with the user's privileges, but only after the user has opted in twice.

Why it is reported

This is the same class as CFG047 (a folderOpen task) and CFG086 (a hook on a zero-click event): repository content that executes because the project was opened. cfgaudit does not analyse the code; the finding is about the trigger, and it fires even when the plugin looks harmless, because the reader has to review it before the first run.

Committing a plugin for the team is a documented OpenCode workflow, so a finding here is often expected. Once the code is reviewed, list the file under exclude-paths in .cfgaudit.yml (for example ".opencode/plugin/notify.ts"), or set CFG114: warn there if the repository commits plugins as a matter of course.

Trigger example

.opencode/
  plugin/
    notify.ts      ← CFG114
  tools/
    deploy.js      ← CFG114

Safe alternative

Install plugins a contributor chooses in their user config (~/.config/opencode/plugin/) instead of the repository, or keep the committed plugin and review every change to it like any other code that runs on checkout.

References

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation