opencode-mirror
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (MEDIUM): The skill clones a repository from an untrusted GitHub source. Evidence:
git clone https://github.com/anomalyco/opencode vendor/opencode. The organization 'anomalyco' is not present in the trusted GitHub organizations list. - [COMMAND_EXECUTION] (LOW): The skill uses shell-based git commands to manage a local directory. Evidence:
git -C vendor/opencode pull --ff-only. - [Indirect Prompt Injection] (LOW): The skill ingests untrusted external code for 'self-reference', which creates a surface for malicious instructions to influence the agent. 1. Ingestion points: Files within
vendor/opencode. 2. Boundary markers: None present. 3. Capability inventory: Git clone and pull operations. 4. Sanitization: None present.
Audit Metadata