x9-opencode-sessions
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external OpenCode sessions which serves as an attack surface for indirect prompt injection.
- Ingestion points: Data is fetched from the OpenCode V2 Sessions API via
scripts/opencode_sessions.pyduringlist,show,messages, andmessageoperations. - Boundary markers: The skill does not implement delimiters or safety instructions to prevent the agent from following commands embedded in the fetched session text.
- Capability inventory: The skill has the ability to send messages to other sessions using the
promptcommand (viaopencode2 api POST). - Sanitization: The wrapper script performs structural normalization of JSON data but does not sanitize or filter the actual text content for injection patterns.
- [COMMAND_EXECUTION]: The skill executes the
opencode2command-line tool via thesubprocessmodule inscripts/opencode_sessions.py. While the implementation uses argument lists to mitigate shell injection, it allows the agent to execute actions through an external binary.
Audit Metadata