opencode-delegate — security audits

Review recommended

Independent security partners scan this skill's files for malicious content, prompt injection and risky patterns. Verdicts below come from the skills.sh audit program; each partner links to its full report.

• Gen Agent Trust Hub

  warn

  This skill provides a bridge to the OpenCode CLI for delegating coding tasks. A security analysis identified a potential command injection vulnerability in the relay script when executed on Windows systems. The skill also facilitates remote code implementation through the OpenCode tool and presents an indirect prompt injection surface.

  Risk: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTIONJul 27, 2026Full report

• Socket

  pass

  No alerts

  Jul 27, 2026Full report

• Snyk

  pass

  Risk: LOW · No issues

  Risk: LOWJul 27, 2026Full report