soia-env-opencode-cli-install
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses
subprocess.runinscripts/inspect_cli.pyto check the version of theopencodecommand. This is restricted to standard version arguments and utilizes regex-based parsing to extract version strings safely. - [SAFE]: Remote data fetching in
scripts/check_latest.pytargets official registries including GitHub APIs, npm Registry, and PyPI. These are well-known services used for legitimate version discovery and satisfy the trust requirements for external communications. - [SAFE]: The skill implements strict boundary guidelines regarding sensitive data. It explicitly avoids reading or echoing credentials (API keys, tokens) and limits its file system checks to verifying the existence of configuration and authentication files without reading their contents.
- [SAFE]: Installation and update procedures are designed to be user-guided and transparent. The skill prefers user-level installations to avoid elevated privileges and requires explicit user confirmation before performing updates.
Audit Metadata