opencode-ensemble
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/check.pyutilizessubprocess.runto execute internal validation tools such asvalidate_skill.pyandpackage.py. These tools are used for linting and verifying the skill's structure and portability during development. - [EXTERNAL_DOWNLOADS]: The documentation includes instructions for installing the skill from its upstream source using
npx, a standard package runner for Node.js. - [DATA_EXFILTRATION]: No exfiltration patterns were found. The validation scripts in
scripts/asset_toolkit/contain regular expressions to detect absolute system paths (e.g.,/etc/,/root/). This functionality is used to audit the skill's own content for portability issues and does not represent an attempt to access or exfiltrate sensitive data. - [PROMPT_INJECTION]: The skill provides operational guidance and coordination logic for multi-agent workflows. It does not contain instructions intended to bypass safety guardrails, override system constraints, or extract internal prompts.
Audit Metadata