opencode-recover-project
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process past session artifacts and conversation history. This constitutes an untrusted data surface where instructions embedded in historical data could potentially influence the agent during the reconstruction process.
- Ingestion points: Session search outputs, message excerpts, and snapshot/diff artifacts accessed via
opencode-sessionsinSKILL.md. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when processing recovered text.
- Capability inventory: The skill has the capability to write to the filesystem by applying recovered patches.
- Sanitization: No explicit validation or sanitization of the recovered content is performed before the patches are applied to the working tree.
- [COMMAND_EXECUTION]: The skill instructions include executing a local command-line tool via
pnpmto search for session data. - Evidence: The skill invokes
pnpm -C packages/reconstituter opencode-sessions search "<query>"to locate relevant artifacts. This command targets a local package within the project structure.
Audit Metadata