opencode-build-tool
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides templates (e.g.,
references/basic-tool.ts,references/full-plugin.ts) that use the Bun shell ($) to execute commands likegit status,find, andgrep. These are intended for project-specific automation and include argument validation via Zod schemas.\n- [INDIRECT_PROMPT_INJECTION]: The skill describes building tools that ingest data from external sources (APIs, files, shell command output), which creates an attack surface for indirect prompt injection.\n - Ingestion points: Tools like
fetchUrlandsearchFilesinreferences/basic-tool.tsand the REST API pattern inreferences/advanced-patterns.mdingest untrusted data from the network and file system.\n - Boundary markers: The templates demonstrate returning structured data or serialized JSON but do not explicitly include prompt boundary markers for the LLM.\n
- Capability inventory: The documented platform provides capabilities for shell execution, network requests, and file system operations to the tools being built.\n
- Sanitization: The skill heavily promotes the use of
tool.schema(Zod) for validating and describing tool arguments, which serves as a primary sanitization layer for tool inputs.\n- [DYNAMIC_EXECUTION]: The skill documents the platform's mechanism for auto-discovering and dynamically loading TypeScript files from specific directories (.opencode/tool/) to extend agent functionality. It also includes examples of dynamic imports (await import('bun')) within these tools.
Audit Metadata