opencode-server-launcher
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill employs authoritative markers such as '🚫 CRITICAL MISTAKES TO AVOID', 'IMPORTANT', and 'UNIVERSAL TRUTH' to override standard agent behaviors. It explicitly instructs the agent to never use timeouts or logging/redirection when launching server processes. Forbidding redirection ('WRONG: ... > /tmp/server.log 2>&1') prevents the creation of audit trails, while forbidding timeouts prevents the system from automatically cleaning up potentially hung or malicious processes.
- [INDIRECT_PROMPT_INJECTION]: The skill architecture involves loading configuration and instructions for 'custom agents' from the local filesystem ('.opencode/agent/') and provides an API to read arbitrary file contents, creating a surface where malicious instructions in data could be processed.
- Ingestion points: Loading agent metadata and instructions from '.opencode/agent/' and reading project files via the '/file/content' API endpoint.
- Boundary markers: Absent; there are no instructions to use delimiters or ignore instructions embedded in the processed configuration files.
- Capability inventory: Execution of shell commands ('opencode', 'curl', 'kill', 'pkill', 'npm', 'docker'), background process management, and local file writing.
- Sanitization: Absent; the instructions do not provide for validation or escaping of content read from external files or configurations.
- [COMMAND_EXECUTION]: The skill demonstrates and encourages the use of shell process management, including backgrounding commands ('&'), manual PID extraction ('$!'), and process termination ('kill', 'pkill'). Additionally, the 'Quick Start' instructions provide an example command that binds the server to all interfaces ('--hostname 0.0.0.0'), which could expose the server to external networks if the user is not careful.
Audit Metadata