easy-opencode

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is a simple, disclosed wrapper for using the opencode CLI on coding tasks, but users should trust their installed opencode binary and review any repository changes it makes.

This skill appears coherent and purpose-aligned. Before installing, make sure the opencode binary on your machine is trusted, run it only in repositories you intend to modify, review the plan and file diffs before accepting changes, and use a fresh opencode session for sensitive or unrelated work.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

opencode may make code changes in the selected repository, so mistakes or misunderstood instructions could affect the project.

Why it was flagged

The skill intentionally delegates code planning and implementation to the opencode CLI inside a repository. This is aligned with the skill purpose, but it gives an external coding tool authority to act on project files.

Skill content
All planning and coding happens inside Opencode. ... build agent: run with `cd [repo dir] && opencode run "[instructions/questions]" --continue --agent build`
Recommendation

Use it only in the intended repository, review the plan and resulting diffs, run tests, and use safe quoting for repository paths and instruction text.

What this means

The safety of actual execution depends largely on the opencode installation already present on the machine.

Why it was flagged

The skill contains no bundled executable code, but its behavior depends on a separately installed opencode binary whose source and version are not established by these artifacts.

Skill content
Source: unknown; Homepage: none; Required binaries (all must exist): opencode; No install spec — this is an instruction-only skill.
Recommendation

Install opencode from a trusted source, verify its version and configuration, and avoid using an unknown or unexpected binary on sensitive repositories.

What this means

Prior opencode context could influence later planning or build steps, and task details may remain in opencode's session context.

Why it was flagged

Both documented commands use --continue, indicating the opencode session may carry context forward between invocations.

Skill content
opencode run "[instructions/questions]" --continue --agent plan ... opencode run "[instructions/questions]" --continue --agent build
Recommendation

Use fresh sessions for unrelated or sensitive work, and avoid passing secrets unless opencode is configured and trusted to handle them.