add-opencode
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@opencode-ai/sdkandopencode-aiCLI (v1.4.17). These are documented as necessary dependencies for the OpenCode provider integration and are installed using standard package managers (Bun). The version pinning is used as a stability measure to prevent API mismatches. - [COMMAND_EXECUTION]: The skill executes standard build and test commands (
pnpm run build,bun test,docker builder prune). These are used to wire the new provider into the application and container images and to validate the configuration. - [DATA_EXPOSURE_&_EXFILTRATION]: The skill provides instructions for managing API keys for providers like DeepSeek and OpenRouter. It correctly advises using
oneclisecrets management and host environment variables rather than hardcoding credentials into source code. The network operations (API base URLs) are directed to well-known LLM provider endpoints (OpenRouter, DeepSeek, Anthropic) as part of the core functionality. - [PRIVILEGE_ESCALATION]: The removal documentation mentions
launchctlandsystemctlfor restarting services. These are standard service management operations and are performed within the user context (--userorgui/$(id -u)), not targeting root privilege escalation. - [DYNAMIC_EXECUTION]: The skill utilizes runtime file modifications (appending imports to barrel files) to register the provider. While dynamic, this is a standard plugin registration pattern for this specific software architecture and is verified by included test files.
Audit Metadata