opencode-qa
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates and executes Node.js and Bun scripts at runtime using shell heredocs. This pattern is extensively utilized in
scripts/lsp-e2e.shandscripts/lib/common.shfor environment probes and automated contract verification tests. - [DATA_EXFILTRATION]: Several helper scripts, such as
scripts/db-session-by-id.shandscripts/db-session-by-text.sh, access and read sensitive session data directly from the local SQLite database at~/.local/share/opencode/opencode.db. - [COMMAND_EXECUTION]: The skill makes extensive use of system commands and subprocesses via tools like
opencode,sqlite3,curl,jq,tmux,bun,node,npm, andpython3to facilitate its QA operations and manage local server instances. - [INDIRECT_PROMPT_INJECTION]: The skill provides tools to extract and search session history from databases which store untrusted user messages. This creates a vulnerability surface if the extracted content is processed by an agent without sufficient sanitization.
- Ingestion points: Session search and export functionality in
scripts/db-session-by-text.shandscripts/export-roundtrip.sh. - Boundary markers: The extraction scripts do not implement delimiters or instructions to differentiate retrieved data from executable agent commands.
- Capability inventory: The skill's environment allows for significant command execution and system interaction through multiple CLI utilities.
- Sanitization: While SQL inputs are escaped to prevent database injection, the message content itself is not filtered or sanitized for malicious instructions.
Audit Metadata