The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill requires the installation of the opencode-ai package via npm or a custom Homebrew tap (anomalyco/tap/opencode). This involves downloading and executing code from external sources that are not part of the platform's trusted vendor list.
[COMMAND_EXECUTION]: The skill makes extensive use of terminal and process commands to interact with the system and the external coding agent, which is granted significant autonomy over the project workspace.
[PROMPT_INJECTION]: The skill enables workflows where it clones remote repositories and attaches arbitrary files for analysis by an autonomous agent, creating an attack surface for indirect prompt injection.
Ingestion points: Usage of git clone to pull remote code and the -f flag in SKILL.md to attach files for processing.
Boundary markers: The instructions lack specific delimiters or warnings to the agent to treat external code as untrusted data rather than instructions.
Capability inventory: The opencode agent can read and modify files, run commands, and perform long-running tasks via the terminal tool.
Sanitization: There are no procedures defined for validating or filtering the contents of remote repositories before the agent processes them.

opencode