The Agent Skills Directory

[DATA_EXFILTRATION]: The skill documentation defines a persistent storage location for sensitive authentication credentials at ~/.opencode/provider-fallback/auth.json and tokens.json. Accessing or exposing these files would compromise AI provider account security. While the documentation mentions strict file permissions, the existence of a standard location for multiple provider secrets increases the risk of data exposure.
[CREDENTIALS_UNSAFE]: The instructions demonstrate handling of sensitive API keys and session tokens, providing examples like sk-ant-.... This encourages users to pass secrets through command-line arguments, which can lead to them being logged in plain text in shell history or process listings.
[NO_CODE]: The skill consists entirely of markdown documentation and a JSON metadata report. No executable scripts, binaries, or automated code snippets are included in the package, meaning it relies on the agent's interpretation of the instructions to perform tasks.

provider-management