opencode-recover-project

SUSPICIOUS. The skill’s recovery workflow is broadly coherent, but it relies on an unverified repo-local helper (`opencode-sessions` in `packages/reconstituter`) that is not confirmed as the official OpenCode path. No clear credential theft or exfiltration is shown, so this is not malicious; the main concern is install/execution trust and opaque provenance of the actual tool being run.