The Agent Skills Directory

[SAFE]: The skill is designed as a developer utility for quality assurance. It demonstrates security best practices by implementing an isolation harness in 'scripts/lib/common.sh' that redirects application data and configuration to temporary directories (XDG sandboxing). This ensures that testing activities, such as spawning local servers or the TUI, do not corrupt or modify the user's production database at '~/.local/share/opencode/opencode.db'.\n- [COMMAND_EXECUTION]: The skill uses local CLI tools such as 'sqlite3', 'curl', 'jq', 'tmux', and 'bun' to interact with the application and its data. These commands are executed locally to facilitate debugging and smoke-testing of the application's core functionality. All command patterns are standard for the intended QA purposes.\n- [DATA_EXFILTRATION]: While the skill accesses the local SQLite database to investigate session history, all operations are intended for local inspection. No unauthorized network activity or exfiltration to external domains was identified. Network requests are restricted to localhost (127.0.0.1) for testing the internal HTTP server.\n- [REMOTE_CODE_EXECUTION]: The skill includes a local mock server ('scripts/lib/fake-openai-server.mjs') used to simulate LLM provider responses for testing purposes. This allow for deterministic verification of the application's logic without requiring external network connectivity or real API keys. No patterns of fetching and executing code from remote servers were found.

opencode-qa