opencode-docs

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). Yes — the skill explicitly ingests untrusted third‑party content: reference/github-integration.md describes reading Issue/PR comments to trigger actions, and the tool references (webfetch/websearch and the CLI import <file|url>) indicate the agent fetches arbitrary public web pages/URLs and acts on their contents, allowing user-generated web content to influence tool use.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill exposes shell execution and file-modification tools (bash, edit, write, patch) and includes example installation commands that use sudo (e.g., sudo pacman -S), which could lead an agent to alter system state or obtain elevated actions.