opencode-ensemble

Pass

Audited by Gen Agent Trust Hub on Jul 7, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/check.py utilizes subprocess.run to execute internal validation tools such as validate_skill.py and package.py. These tools are used for linting and verifying the skill's structure and portability during development.
  • [EXTERNAL_DOWNLOADS]: The documentation includes instructions for installing the skill from its upstream source using npx, a standard package runner for Node.js.
  • [DATA_EXFILTRATION]: No exfiltration patterns were found. The validation scripts in scripts/asset_toolkit/ contain regular expressions to detect absolute system paths (e.g., /etc/, /root/). This functionality is used to audit the skill's own content for portability issues and does not represent an attempt to access or exfiltrate sensitive data.
  • [PROMPT_INJECTION]: The skill provides operational guidance and coordination logic for multi-agent workflows. It does not contain instructions intended to bypass safety guardrails, override system constraints, or extract internal prompts.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 7, 2026, 06:43 AM
Security Audit — agent-trust-hub — opencode-ensemble