opencode-review
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates a shell script by interpolating user-supplied arguments (the review target and the model name) into a template. This script is then passed to a subagent with instructions to run it 'exactly as written'. This pattern is vulnerable to command injection if the user provides a crafted branch name or ref range that includes shell special characters or expansions like backticks or
$(...)(SKILL.md). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the repository, such as code and git diffs, using an external model. This content could contain malicious instructions designed to manipulate the review output or influence the reviewer model's behavior.
- Ingestion points: Repository files and git diffs accessed via the
opencodetool (SKILL.md). - Boundary markers: Absent. The instructions do not specify any delimiters or safety warnings to prevent the model from following instructions embedded in the code under review.
- Capability inventory: The subagent is authorized to run
opencode,mktemp,tee, and shell pipes. Theopencodeprocess is granted access to the repository directory via the--dirflag (SKILL.md). - Sanitization: None. The skill relays the resulting review verbatim to the user without validation or filtering.
Audit Metadata