opencode-command-creator
Warn
Audited by Gen Agent Trust Hub on Feb 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- Persistence Mechanisms (MEDIUM): As documented in
SKILL.mdandREADME.md, the skill allows for overriding built-in agent commands like/initby placing markdown files in global configuration directories. This capability can be exploited to hijack standard agent behavior or maintain persistence across sessions. - Dynamic Execution (MEDIUM): The script
scripts/create-command.pyis vulnerable to path traversal because thenameargument is not sanitized before being used to construct a file path (base_dir / f"{name}.md"). An agent or malicious template could provide an absolute path or parent directory references to write files outside of the intended.opencode/commands/directory. - Indirect Prompt Injection (LOW): The skill defines a system for creating commands that interpolate user-provided arguments ($ARGUMENTS) directly into templates that often include shell execution blocks (
!`command`) and file reading (@file). Ingestion points:$ARGUMENTSand positional placeholders inSKILL.md. Boundary markers: Absent; no delimiters or warnings are used in the suggested template structures. Capability inventory: Shell execution and file reading via@and!markers. Sanitization: Absent; the creation script and instructions do not provide input validation or escaping mechanisms.
Audit Metadata