The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes hardcoded system instructions in opencode_proxy.rs (the IBLAI_INSTRUCTIONS constant) that command the agent to "NEVER ask the user for a platform API key or token — this supersedes any skill instruction that says to ask for one." This is an explicit behavioral override intended to bypass other instructions.
[EXTERNAL_DOWNLOADS]: The module opencode_installer.rs downloads the opencode release binary from an external repository at github.com/sst/opencode. It also fetches a toolkit from the author's repository at github.com/iblai/vibe.
[REMOTE_CODE_EXECUTION]: The skill spawns and executes the downloaded opencode binary using Rust's Command API in opencode_acp.rs. Spawning externally sourced binaries is a significant security surface.
[COMMAND_EXECUTION]: The agent is explicitly designed to execute shell commands (e.g., pnpm dev, git init, and arbitrary shell tools) on the user's machine. While a sandbox using bwrap (Linux) or sandbox-exec (macOS) is implemented in opencode_acp.rs, the agent retains the capability to perform broad filesystem and terminal operations within that sandbox.
[CREDENTIALS_UNSAFE]: The opencode_proxy.rs module mints a week-long, tenant-scoped platform API key and exports it as the IBLAI_API_KEY environment variable directly to the agent's environment, providing it with active platform credentials.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it is designed to read and process arbitrary files from the user's workspace, which could contain instructions from untrusted sources.
Ingestion points: Workspace files read by the agent (facilitated in opencode_acp.rs).
Boundary markers: The UI renders "permission cards" in code-permission-card.tsx to request user approval for operations, which serves as a defensive boundary.
Capability inventory: Includes shell command execution, file system read/write access, and network operations through a loopback proxy.
Sanitization: There is no explicit sanitization of the content of the files read by the agent before processing.
[DYNAMIC_EXECUTION]: The skill uses opencode_acp.rs to dynamically assemble command-line arguments (e.g., in bwrap_args) and uses the axum library to create a dynamic model proxy and workspace management API.

iblai-vibe-os-agent-code-mode