opencode-env-setup

Pass

Audited by Gen Agent Trust Hub on Aug 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches installation scripts and software packages from official domains.
  • Downloads Node.js setup scripts from the official Nodesource repository.
  • Retrieves the uv package manager installer from the Astral project's verified site.
  • Downloads GitHub CLI and OpenCode Desktop components from their respective official distributions.
  • [REMOTE_CODE_EXECUTION]: Executes installation scripts using shell-piping methods (curl | bash and irm | iex).
  • These scripts are sourced from official and well-known service domains associated with the tools being installed.
  • The instructions include a transparent warning to the user regarding the trust requirements of these installation methods and provide manual download alternatives.
  • [COMMAND_EXECUTION]: Performs system-level operations to detect and install software across different operating systems.
  • Utilizes native system tools like winget on Windows, brew on macOS, and apt or dnf on Linux.
  • Requires administrative privileges (sudo) for certain Linux installation steps, which is appropriate for the skill's purpose of environment configuration.
  • [CREDENTIALS_UNSAFE]: Promotes secure configuration management.
  • The skill explicitly advises against the use of plaintext API keys and provides instructions for using environment variables or external secret files for authentication.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 8, 2026, 02:21 AM
Security Audit — agent-trust-hub — opencode-env-setup