The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation in SKILL.md and reference/getting-started.md promotes a high-risk installation command: curl -fsSL https://opencode.ai/install | bash. This pattern downloads and executes a script from an external, untrusted source with full shell privileges. This poses a critical risk as the script could be modified to perform malicious actions on the user's system without prior inspection.
[COMMAND_EXECUTION]: The documentation instructs the AI agent to execute arbitrary shell commands using the ! prefix (e.g., !ls -la) or the bash tool. This capability allows the agent to interact with the host operating system, including file system modifications and network operations, which significantly expands the attack surface if the agent is misled by malicious input.
[EXTERNAL_DOWNLOADS]: The skill references several external resources, including the opencode.ai website, GitHub repositories (anomalyco/opencode), and Discord servers. It also documents the automatic download of LSP servers and the configuration of MCP servers from remote URLs in reference/tools.md.
[PROMPT_INJECTION]: The skill documentation establishes an environment susceptible to indirect prompt injection by teaching the agent to ingest untrusted data from the local environment. Ingestion points: The agent is instructed to read local file contents via the @ prefix and to capture the output of shell commands (SKILL.md, reference/getting-started.md). Boundary markers: The documentation does not provide the agent with instructions or markers to distinguish between trusted system commands and potentially adversarial content within the ingested files or command outputs. Capability inventory: The agent is granted extensive capabilities, including executing shell commands via bash, modifying files via edit and write, and performing network operations via webfetch and websearch (SKILL.md, reference/tools.md). Sanitization: There is no evidence of validation or sanitization mechanisms to prevent the LLM from executing instructions embedded within the data it reads.

opencode-docs