The Agent Skills Directory

COMMAND_EXECUTION (MEDIUM): The skill performs dynamic process replacement and command execution using binaries discovered at runtime.
Evidence: In venv_utils.py, the ensure_local_skill_venv function identifies Python interpreters on the system (via the PATH environment variable or the OPENCODE_ACP_PYTHON variable) and re-executes the current script using os.execvpe with the resolved path. This pattern of executing code from computed paths is a dynamic execution risk.
Evidence: The scripts opencode_monitor.py, opencode_realtime.py, and opencode_wrapper.py use the subprocess module to execute commands constructed in runner_utils.py, which targets the opencode_acp_client.py script.
PROMPT_INJECTION (LOW): User-supplied task instructions are passed directly to the underlying agent client without validation.
Evidence: In opencode_monitor.py and other entry points, the task argument is taken directly from sys.argv[2] and passed to the agent client. This allows a user to provide malicious instructions that might attempt to override system prompts or bypass safety filters.
INDIRECT_PROMPT_INJECTION (LOW): The skill processes untrusted data from a project directory, which could contain malicious instructions.
Ingestion points: The project_dir argument (e.g., in opencode_monitor.py) points to external file content that is processed by the AI client.
Boundary markers: There are no delimiters or safety warnings in the wrapper scripts to isolate the project data from the agent's instruction stream.
Capability inventory: The skill is capable of executing subprocesses and modifying local files through the ACP client.
Sanitization: No sanitization or validation of the project directory contents or the task prompt is performed.

opencode-acp