skills/nanocoai/nanoclaw/add-opencode/Gen Agent Trust Hub

add-opencode

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the @opencode-ai/sdk and opencode-ai CLI (v1.4.17). These are documented as necessary dependencies for the OpenCode provider integration and are installed using standard package managers (Bun). The version pinning is used as a stability measure to prevent API mismatches.
  • [COMMAND_EXECUTION]: The skill executes standard build and test commands (pnpm run build, bun test, docker builder prune). These are used to wire the new provider into the application and container images and to validate the configuration.
  • [DATA_EXPOSURE_&_EXFILTRATION]: The skill provides instructions for managing API keys for providers like DeepSeek and OpenRouter. It correctly advises using onecli secrets management and host environment variables rather than hardcoding credentials into source code. The network operations (API base URLs) are directed to well-known LLM provider endpoints (OpenRouter, DeepSeek, Anthropic) as part of the core functionality.
  • [PRIVILEGE_ESCALATION]: The removal documentation mentions launchctl and systemctl for restarting services. These are standard service management operations and are performed within the user context (--user or gui/$(id -u)), not targeting root privilege escalation.
  • [DYNAMIC_EXECUTION]: The skill utilizes runtime file modifications (appending imports to barrel files) to register the provider. While dynamic, this is a standard plugin registration pattern for this specific software architecture and is verified by included test files.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 02:00 AM
Security Audit — agent-trust-hub — add-opencode