Opencode-controller

Control and operate Opencode via slash commands. Use this skill to manage sessions, select models, switch agents (plan/build), and coordinate coding through Opencode.

Security Scan

Instruction-only skill to operate Opencode via slash commands; it asks for user confirmation and does not request extra credentials or install software, though it will instruct the agent to copy and forward login links (handle those carefully).

Purpose & Capability

The name/description (Opencode control via slash commands) aligns with the instructions: start Opencode, use /sessions, /agents, /models and coordinate Plan/Build. No unrelated binaries, installs, or env vars are requested.

Instruction Scope

The SKILL.md stays within the stated purpose (session, agent and model selection, Plan/Build workflows). One noteworthy behavior: it explicitly instructs the agent to copy Opencode-generated login URLs and send them to the user verbatim — this is coherent for provider authentication, but forwarding raw login links can expose embedded tokens if present, so handle links conservatively.

Install Mechanism

No install spec and no code files — instruction-only. This minimizes disk writes and arbitrary code execution risk.

Credentials

The skill requests no environment variables, credentials, or config paths. The authentication flow relies on the user and Opencode UI rather than supplied secrets, which is proportionate to the stated purpose.

Persistence & Privilege

always is false and the skill does not request system-wide changes or persistent privileges. It also does not attempt to modify other skills or agent configurations.

Assessment

This skill is coherent and low-risk because it's instruction-only and requests no credentials or installs. Before using it: ensure you trust the Opencode instance it will operate, and be careful when copying or sharing any login URLs — check whether the URL contains session tokens or one-time auth codes before forwarding. Only approve authentication flows you initiated, and avoid pasting provider tokens into untrusted chat windows or third-party services.

Core rule

Clawdbot does not write code. All planning and coding happens inside Opencode.

Pre-flight

• Ask the user which AI provider to use.
• Ask how the provider should be authenticated.
• Do not proceed without confirmation.

Session management

• Start Opencode.
• Open session selector using: /sessions
• If the current project already exists:
  • Select the existing session.
• Never create a new session without user approval.

Agent (mode) control

• Open agent selector using: /agents
• Available agents:
  • Plan
  • Build
• Always select Plan first.
• Switch agents whenever required using /agents.

Model selection

• Open model selector using: /models
• Select the user-requested provider.
• If authentication is required:
  • Copy the login link provided by Opencode.
  • Send it to the user.
  • Wait for confirmation before continuing.

Plan agent behavior

• Ask Opencode to analyze the task.
• Request a clear step-by-step plan.
• Allow Opencode to ask clarification questions.
• Review the plan carefully.
• If the plan is incorrect or incomplete:
  • Ask Opencode to revise it.
• Do not allow code generation in Plan.

Build agent behavior

• Switch to Build using /agents.
• Ask Opencode to implement the approved plan.
• If Opencode asks any question:
  • Immediately switch back to Plan.
  • Answer and confirm the plan.
  • Switch back to Build.

Completion

• Repeat the Plan → Build loop until all user requirements are satisfied.
• Never skip Plan.
• Never answer questions in Build.

Output format

• Show all slash commands explicitly.
• State which option is selected.
• Provide login links verbatim.