opencode
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill functions as a technical manual and boilerplate repository for building extensions. It does not contain executable code that performs malicious actions.
- [SAFE]: All sensitive information mentioned in the documentation, such as API keys (e.g.,
ANTHROPIC_API_KEY=sk-ant-xxx) and authorization tokens, uses safe placeholders and standard environment variable patterns. - [SAFE]: The skill explicitly includes a security best practices section that teaches developers how to implement path validation and access control (e.g.,
isWithinProjectchecks) to prevent directory traversal vulnerabilities in their custom tools. - [SAFE]: Dependency management and build instructions (e.g.,
npm install,bun build) are standard for Node.js/TypeScript development and do not involve suspicious remote script execution.
Audit Metadata