The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches the Docker image ghcr.io/luongnv89/devbox:latest from the author's public GitHub Container Registry to initialize the sandbox environment.
[COMMAND_EXECUTION]: Executes several docker CLI commands (run, exec, cp, rm, start, inspect) to manage the container's operational state and run the OpenCode assistant inside the sandbox.
[DATA_EXFILTRATION]: By default, the skill mounts the host's ~/.ssh and ~/.config/gh directories and injects a GH_TOKEN into the container environment. This is a documented feature enabling the agent to perform pull request and push operations. The skill explicitly provides --no-ssh and --no-github flags for users wishing to isolate the sandbox from their GitHub credentials, and it warns about the risk associated with its non-interative --auto mode.
[REMOTE_CODE_EXECUTION]: Documentation for interactive mode suggests installing or updating a helper utility (cdev) via a curl | bash command targeting the author's own GitHub repository (github.com/luongnv89/docker-dev). This represents expected setup behavior for the vendor's tools.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an ingestion surface for untrusted data by mounting the project directory into the sandbox. Malicious instructions embedded in project files could theoretically be processed by the OpenCode agent. This risk is mitigated by the sandboxed nature of the execution and the documented isolation controls.

opencode-sandbox