opencode-command-authoring

SUSPICIOUS: The stated purpose is coherent, but the skill relies on undocumented repo-local executables (`bin/create-command`, `bin/opencode-command`) rather than the official OpenCode workflow documented upstream. No clear credential theft or malicious exfiltration is shown, but install/execution trust is weak because the agent is asked to execute opaque local tooling whose provenance cannot be verified from the skill.