opencode-qa
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes common command-line utilities including
sqlite3,curl,jq, andtmuxto automate QA tasks. All spawned processes are tracked and terminated upon exit using a trap-based cleanup mechanism inscripts/lib/common.sh. - [DATA_EXFILTRATION]: The skill is designed to read the local
opencodedatabase (~/.local/share/opencode/opencode.db) to enable session inspection and debugging. This access is limited to read-only operations for investigation purposes, while tests that could write data are strictly sandboxed using temporaryXDG_DATA_HOMEandXDG_CONFIG_HOMEdirectories. - [REMOTE_CODE_EXECUTION]: A bundled Node.js/Bun script (
fake-openai-server.mjs) is used to host a local mock LLM server. This enables deterministic testing of agent workflows without requiring external network access to real LLM providers. - [PROMPT_INJECTION]: The skill reads and processes session history and message text from the agent's database. While this constitutes an indirect prompt injection surface, the risk is mitigated as the tool is intended for developer-led diagnostics, and SQL inputs are appropriately escaped.
Audit Metadata