opencode-docs

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The docs include a direct install command that downloads and executes remote code via curl -fsSL https://opencode.ai/install | bash (references/README.md) and a runtime "opencode import https://opncd.ai/s/abc123" example (references/web/cli.mdx) that imports remote session data which can inject prompts — both are high-risk external fetches that execute code or directly control agent prompts.