The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md file contains a prerequisite instruction to install the OpenCode CLI using curl -fsSL https://raw.githubusercontent.com/opencode-ai/opencode/refs/heads/main/install | bash. This pattern executes unverified code from a remote server directly in the shell, posing a critical security risk.
[COMMAND_EXECUTION]: The script scripts/run_opencode.py executes the opencode command-line tool using subprocess.run and subprocess.Popen. While it uses shlex.quote to mitigate basic shell injection, it explicitly operates in a mode where all permissions are auto-approved, increasing the risk of autonomous actions.
[DATA_EXFILTRATION]: The skill reads local files through functions like load_text_file and arguments like --file or --session-file. This data is then interpolated into prompts sent to external LLM providers (e.g., Anthropic, OpenAI, Google) via the OpenCode CLI.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection.
Ingestion points: Untrusted data enters the agent context via the prompt argument, --prompt-file, and --session-file in scripts/run_opencode.py.
Boundary markers: Absent. The script concatenates these inputs into a single string without delimiters or instructions to the model to ignore embedded commands.
Capability inventory: The skill can execute arbitrary commands via the opencode CLI and read any file the user has access to (scripts/run_opencode.py).
Sanitization: There is no validation or escaping performed on the content of the ingested files before they are sent to the LLM.

opencode-runner