anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[FEATURE]:建议创造一个插件市场，对插件需要做到安全审查 #6761

New Issue
Open
opened 2026-02-16 18:05:11 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:05:11 -05:00
Owner
Copy Link
Copy Source

Originally created by @aokihu on GitHub (Jan 19, 2026).

Originally assigned to: @thdxr on GitHub.

Feature hasn't been suggested before.

  • I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

opencode的插件机制太开放，缺少必要的安全审查，如果有危害代码在插件中会给开发者带来潜在的安全风险。建议建立一个插件市场，对插件进行安全检查后提供统一的路径安装插件

Originally created by @aokihu on GitHub (Jan 19, 2026). Originally assigned to: @thdxr on GitHub. ### Feature hasn't been suggested before. - [x] I have verified this feature I'm about to request hasn't been suggested before. ### Describe the enhancement you want to request opencode的插件机制太开放，缺少必要的安全审查，如果有危害代码在插件中会给开发者带来潜在的安全风险。建议建立一个插件市场，对插件进行安全检查后提供统一的路径安装插件
yindo added the discussion label 2026-02-16 18:05:11 -05:00
yindo commented 2026-02-16 18:05:11 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 19, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #8386: [FEATURE]: Skill Registry + Installer for Awesome-Claude-Skills - proposes a comprehensive registry and installation system for skills with security considerations including permission confirmations, provenance tracking, and license warnings
  • #7163: Security Issue - Autoloading Repository Plugins - addresses the critical security concern of automatically loading untrusted plugins from repositories without user confirmation
  • #8208: [FEATURE]: Plugin install - add to trusted dependencies - proposes marking plugins as trusted (similar concept to a curated plugin marketplace)
  • #6043: [FEATURE]: Add askPermission to plugin ToolContext - allows plugins to request user confirmation before sensitive operations
  • #3471: Streamlined Distribution for Agent Definitions - discusses plugin and package distribution mechanisms

The core request appears to be asking for a plugin marketplace with security review. Issues #8386 and #7163 directly address similar concerns about security, verification, and trusted distribution of extensible components.

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 19, 2026): This issue might be a duplicate of existing issues. Please check: - #8386: [FEATURE]: Skill Registry + Installer for Awesome-Claude-Skills - proposes a comprehensive registry and installation system for skills with security considerations including permission confirmations, provenance tracking, and license warnings - #7163: Security Issue - Autoloading Repository Plugins - addresses the critical security concern of automatically loading untrusted plugins from repositories without user confirmation - #8208: [FEATURE]: Plugin install - add to trusted dependencies - proposes marking plugins as trusted (similar concept to a curated plugin marketplace) - #6043: [FEATURE]: Add askPermission to plugin ToolContext - allows plugins to request user confirmation before sensitive operations - #3471: Streamlined Distribution for Agent Definitions - discusses plugin and package distribution mechanisms The core request appears to be asking for a plugin marketplace with security review. Issues #8386 and #7163 directly address similar concerns about security, verification, and trusted distribution of extensible components. Feel free to ignore if none of these address your specific case.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label discussion
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#6761
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?