The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several system commands to manage the sandbox environment and terminal sessions.
Utilizes docker commands to create the sandbox container, inspect its mounts, and execute verification probes inside it.
Uses tmux to create a detached terminal session for the user.
Performs git commands (fetch, pull, rebase) to synchronize the project's working tree before launching the sandbox.
[EXTERNAL_DOWNLOADS]: The skill downloads the Docker image ghcr.io/luongnv89/devbox:latest from the author's GitHub Container Registry. This is a vendor-owned resource required for the skill's sandbox functionality.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it mounts a user-controlled project directory into a Docker container where an AI agent (OpenCode) operates.
Ingestion points: The project directory is mounted at /workspace inside the container (SKILL.md, scripts/handoff.sh).
Boundary markers: The skill implements a 'credential boundary' to prevent host secret leakage, but it does not include prompt boundary markers for the data within the project directory.
Capability inventory: The environment where the sandboxed agent runs has access to bash, docker, tmux, and git capabilities.
Sanitization: No sanitization or filtering is performed on the files within the project directory before they are exposed to the agent inside the sandbox.

opencode-handoff