opencode-apply-reconstituted-diffs
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external patch files and executes arbitrary test commands provided as input, which serves as a potential surface for indirect prompt injection attacks. \n
- Ingestion points: The skill accepts "Patch files or diff directories" and "Required test or build commands" as inputs in SKILL.md. \n
- Boundary markers: There are no explicit instructions or delimiters defined to separate untrusted data from instructions or to prevent the agent from obeying commands embedded within the diffs. \n
- Capability inventory: The skill utilizes filesystem modification through
git applyand executes shell commands to perform tests or builds (SKILL.md). \n - Sanitization: No explicit sanitization or validation logic is specified for the input patches or the user-provided test commands before they are processed or executed. \n- [COMMAND_EXECUTION]: The skill is designed to execute arbitrary shell commands for validation purposes. \n
- Evidence: The "Steps" and "Inputs" sections in SKILL.md describe receiving and running "Required test or build commands" to verify the workspace. \n- [DYNAMIC_EXECUTION]: The skill executes commands provided at runtime to validate the workspace after patches are applied. \n
- Evidence: The input field "Required test or build commands" is used dynamically in the final step of the skill's workflow to verify consistency.
Audit Metadata