The Agent Skills Directory

[COMMAND_EXECUTION]: The runOpencode function in index.mjs executes a shell command by interpolating the prompt variable directly into a template string passed to execSync. Because shell: true is enabled, an attacker can inject arbitrary shell commands by including metacharacters like ";", "&", or backticks in the task description. Evidence: const output = execSync("opencode run \"${prompt}\" 2>&1", { encoding: 'utf-8', shell: true, }); in index.mjs.\n- [INDIRECT_PROMPT_INJECTION]: The skill accepts untrusted task descriptions and passes them to the opencode agent without sanitization or boundary markers, creating a surface for prompt injection attacks against the sub-agent.\n
Ingestion points: process.argv in index.mjs.\n
Boundary markers: Absent.\n
Capability inventory: Shell command execution (execSync), file system writes (writeFileSync).\n
Sanitization: Absent.

agent