dispatch-opencode
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates and executes local shell scripts (e.g.,
dispatch.sh) to interface with theopencodeCLI in 'cli' mode. It also spawnsopencodeprocesses in ACP and HTTP modes. - [COMMAND_EXECUTION]: Uses
subprocess.runandasyncio.create_subprocess_execto invoke external tools likegitandopencodeto perform repository operations and manage subagent sessions. - [DATA_EXFILTRATION]: Communicates with a local
opencodeserver over HTTP/JSON-RPC on127.0.0.1to monitor session events and verify tool-call arguments. This communication is restricted to local network traffic and is required for the tool's core functionality. - [SAFE]: The skill implements extensive security mitigations, including fail-closed working directory verification (
verify-cwd.sh), tool permission allowlists (gatingbashandedittools), environment variable key validation, and symlink-safe file rewriting in the log processing script (validate-run.sh).
Audit Metadata