opencode-design-commands

SUSPICIOUS: the skill’s purpose is coherent and the referenced OpenCode tooling appears official, but the embedded !`command` examples are actual pre-execution directives rather than inert documentation. That creates medium risk of unintended local command execution and some outbound GitHub queries at load/template time, though there is no clear credential theft, remote-code execution, or attacker exfiltration path.