The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses spawnSync with shell: true in payload/container/agent-runner/src/providers/opencode-memory.ts to execute memory session hooks. This allows the execution of arbitrary shell commands defined in the hook configuration.
[REMOTE_CODE_EXECUTION]: In payload/scripts/opencode-host.ts, the skill downloads the opencode-ai package via npm and then explicitly executes a postinstall.mjs script from the downloaded package using the current Node.js process.
[DYNAMIC_EXECUTION]: The skill dynamically executes Node.js scripts and shell commands at runtime to handle installation, authentication, and memory management, including the use of process.execPath to run setup scripts.
[INDIRECT_PROMPT_INJECTION]: The offerOpenCodeFailureAssist feature in payload/scripts/opencode-host.ts creates a maintenance request file containing external error messages and instructions, then prompts the agent to read and follow those instructions. This creates an attack surface where maliciously crafted error messages could influence agent behavior.
Ingestion points: Error messages (ctx.msg) and hints (ctx.hint) passed to offerOpenCodeFailureAssist in opencode-host.ts; memory hook outputs in opencode-memory.ts.
Boundary markers: The maintenance file uses markdown headers to separate sections, but does not provide strong isolation for the untrusted error content.
Capability inventory: Shell execution (spawnSync), container management (spawn), and file writing capabilities are present across the scripts.
Sanitization: Paths are sanitized using JSON.stringify, but the error content itself is written directly to the diagnostic file.
[DATA_EXFILTRATION]: The skill communicates with an external management service (OneCLI) to store and retrieve sensitive credentials, including API keys and OAuth tokens for various AI providers.

add-opencode