opencode-agents
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides a pathway to process untrusted user instructions through agents with significant system capabilities, creating an injection surface where external data could influence agent behavior.
- Ingestion points: User tasks are passed directly as command-line arguments to the
opencode runcommand as described inSKILL.md. - Boundary markers: The instructions recommend wrapping prompts in single quotes to separate them from the shell command.
- Capability inventory: The subagents mentioned in
SKILL.mdhave capabilities including filesystem exploration (atlas,explore), dependency analysis, and web research (librarian). - Sanitization: The documentation provides a pattern for escaping internal single quotes (
'\'') to maintain shell integrity. - [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill documentation references the installation and use of the
oh-my-openagentpackage from the NPM registry to provide the necessary CLI and agent logic. - [COMMAND_EXECUTION]: The primary function of the skill is to guide an AI agent in executing shell commands using the
opencodebinary. It includes explicit warnings and instructions on shell safety and quoting to mitigate risks during process invocation.
Audit Metadata