opencode

SUSPICIOUS: the skill’s purpose matches its capabilities, but its footprint is high-risk because it delegates local tool use and code changes to an external CLI/model stack, routinely bypasses permission prompts, and supports autonomous/background execution. This looks like a legitimate delegation skill, not confirmed malware, but it materially increases execution and data-exposure risk.