opencode-dev
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes
@memlab/clifrom npm andopencode-aivia bunx. These are recognized tools from trusted or project-related sources.\n- [COMMAND_EXECUTION]: Uses system utilities such askill,pgrep,ps, andsqlite3to interact with local processes and state files, which is required for debugging the client/server architecture of the application.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local logs and server API endpoints (e.g.,packages/cli/src/commands/handlers/serve.ts).\n - Ingestion points: Reads from
~/.local/share/opencode/log/and server responses viabun dev api.\n - Boundary markers: None identified in the instructional text.\n
- Capability inventory: Includes shell command execution, file system access, and network requests to localhost.\n
- Sanitization: Not explicitly defined, as the output is intended for manual developer inspection.
Audit Metadata