opencode-file-toolkit

Fail

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute installation scripts for the uv package manager and Deno runtime using piped shell execution (| sh and | iex). These scripts are fetched from astral.sh and deno.land.
  • [COMMAND_EXECUTION]: The instructions command the agent to run various system-level tools including git clone, powershell, winget, and uv to set up local environments and install system dependencies.
  • [EXTERNAL_DOWNLOADS]: Fetches configuration files and source code from the author's GitHub repository (mathruffian-dot/ai-agent-ep03) and downloads tools from official service domains.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from sources like Word, Excel, PDF files, and YouTube links, combined with capabilities to execute shell commands and modify the file system.
  • Ingestion points: Reads content from external Word, Excel, PowerPoint, PDF, and image files provided by the user.
  • Boundary markers: The skill includes a 'Seven Rules' section that instructs the agent to work only within the project folder and avoid global system changes.
  • Capability inventory: Provides access to powerful CLI tools like yt-dlp, ffmpeg, and uv for downloading content and managing environments.
  • Sanitization: No specific content sanitization or instruction-bypass filtering is mentioned for the processed files.
  • [PROMPT_INJECTION]: Contains a section titled 'Seven Rules for the Agent' which overrides default behavior by directing the agent to ignore certain research steps and strictly adhere to specific directory and installation constraints.
  • [DATA_EXFILTRATION]: Uses the edge-tts tool, which transmits user-provided text to a cloud-based service for speech generation. While this is the tool's primary purpose, it involves sending data to an external API.
Recommendations
  • HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh, https://deno.land/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 28, 2026, 02:34 AM
Security Audit — agent-trust-hub — opencode-file-toolkit