The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run in scripts/generate_html.py to execute its companion script for data extraction. This is implemented using a secure list of arguments with the local Python interpreter, which prevents shell-related injection attacks.\n- [EXTERNAL_DOWNLOADS]: The HTML template in assets/template.html fetches standard libraries like marked.js and highlight.js, along with font files, from trusted public CDNs (Cloudflare and Google) to facilitate Markdown rendering and styling.\n- [DATA_EXFILTRATION]: The skill accesses the local opencode.db SQLite database to read conversation history. This data exposure is limited to the user's local file system and is required for the tool's primary purpose of session visualization.\n- [PROMPT_INJECTION]: The skill processes untrusted session data from the OpenCode database (ingestion point) and interpolates it into an HTML template. This creates a surface for indirect prompt injection if the history contains malicious instructions intended to influence the agent when it later reads the report. The skill implements basic sanitization by escaping closing script tags to prevent structural breakage of the generated HTML.

opencode-session-visualizer