opencode-agent-generator
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCEMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The templates provided for generating agents lack boundary markers or instructions to ignore instructions embedded in data. Given that these generated agents are granted 'bash' access and file 'edit/write' permissions, they are susceptible to indirect prompt injection if they process untrusted project files. Evidence includes ingestion of project data via 'read' and 'grep' tools and a lack of sanitization in the generated system prompts in SKILL.md.
- [PERSISTENCE]: While the README claims agents are project-local, the PROMPT.md file instructs the creation of agents in the global configuration directory (~/.config/opencode/agent/). This allows the generated agents to persist across all user projects and sessions, potentially altering the behavior of the 'opencode' environment globally.
- [METADATA_POISONING]: There is a direct contradiction between the documented location of agents in README.md and SKILL.md (.opencode/agent/) and the implementation path in PROMPT.md (~/.config/opencode/agent/). This inconsistency can deceive users about the scope and visibility of the agents created by the skill.
Audit Metadata