opencode-env-setup
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches installation scripts and software packages from official domains.
- Downloads Node.js setup scripts from the official Nodesource repository.
- Retrieves the uv package manager installer from the Astral project's verified site.
- Downloads GitHub CLI and OpenCode Desktop components from their respective official distributions.
- [REMOTE_CODE_EXECUTION]: Executes installation scripts using shell-piping methods (
curl | bashandirm | iex). - These scripts are sourced from official and well-known service domains associated with the tools being installed.
- The instructions include a transparent warning to the user regarding the trust requirements of these installation methods and provide manual download alternatives.
- [COMMAND_EXECUTION]: Performs system-level operations to detect and install software across different operating systems.
- Utilizes native system tools like
wingeton Windows,brewon macOS, andaptordnfon Linux. - Requires administrative privileges (
sudo) for certain Linux installation steps, which is appropriate for the skill's purpose of environment configuration. - [CREDENTIALS_UNSAFE]: Promotes secure configuration management.
- The skill explicitly advises against the use of plaintext API keys and provides instructions for using environment variables or external secret files for authentication.
Audit Metadata