The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md mandate the use of the opencode CLI with the --dangerously-skip-permissions flag. This flag is designed to auto-approve all tool calls made by the sub-agent, including filesystem modifications and arbitrary bash command execution. This configuration intentionally removes the 'human-in-the-loop' safety constraint, allowing the sub-agent to execute actions that would normally require explicit user consent.
[PRIVILEGE_ESCALATION]: By coupling the --agent build mode (which has write access) with the --dangerously-skip-permissions flag, the skill grants the sub-agent unrestricted autonomy to modify the codebase and execute shell commands without oversight. This effectively escalates the sub-agent's privileges to that of an autonomous administrator within the working directory.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface where user-provided prompts and attached project files are passed to external AI models. Because the sub-agent's actions are auto-approved, a malicious prompt or a poisoned codebase file could cause the sub-agent to execute destructive commands.
Ingestion points: User-provided prompts and codebase files attached via the -f flag in SKILL.md are passed to the opencode CLI.
Boundary markers: The skill uses structural headers (e.g., [CONTEXT], [TASK], [SCOPE]) in prompt templates, but these provide weak logical separation and do not prevent the sub-agent from following instructions embedded within the codebase files.
Capability inventory: The sub-agent has full access to the filesystem and the ability to execute arbitrary shell commands via its internal bash and write_file tools.
Sanitization: There is no evidence of input sanitization or validation of the sub-agent's generated tool calls before execution.
[DYNAMIC_EXECUTION]: The scripts/test_skill.py utility uses subprocess.run with shell=True on Windows platforms to invoke the opencode CLI. This pattern can lead to command injection if parts of the command string (such as the prompt or directory path) are not properly sanitized, especially given the script's use of environment variables like OPENCODE_BIN to define the executable path.

opencode