The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a bundled Bash script (scripts/claude-opencode-worker) to facilitate task delegation. This script in turn executes the opencode CLI tool.
[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by passing instructions (a 'Task') to a secondary agent (opencode). However, the skill implements robust mitigations:
It uses a quoted heredoc (<<'TASK') when calling the script to prevent the task content from being expanded or executed as commands in the main agent's shell environment.
The helper script dynamically generates a configuration for the sub-agent that explicitly denies dangerous commands (e.g., git commit, git push, rm -rf) and restricts file access to the project directory.
The instructions explicitly mandate that the main agent must manually review and validate all changes produced by the sub-agent before acceptance.
[DYNAMIC_EXECUTION]: The helper script uses a short Python snippet to parse a local JSON state file (~/.local/state/opencode/model.json) to determine the last used model for the opencode tool.
[DATA_EXPOSURE]: The script accesses local configuration and state files (~/.config/claude-opencode-worker/deny and ~/.local/state/opencode/model.json) to configure the delegation environment. This is standard behavior for managing local tool state and user-defined security policies.

delegate-to-opencode