Development Coding Agent

Enhanced coding agent for development workflows. Optimized for building features, fixing bugs, and code refactoring with OpenCode integration.

Security Scan

The skill's instructions match its stated purpose (running the OpenCode CLI against a project), but the SKILL.md contains a prompt-injection signal and gives open-ended, autonomous command patterns that could modify files — review provenance and runtime scope before installing.

Purpose & Capability

Name and description describe a coding agent that integrates with OpenCode; the only required binary (opencode) and the Git repository requirement are coherent with that purpose. No unrelated credentials, config paths, or unexpected binaries are requested.

Instruction Scope

Runtime instructions direct the agent to run freeform 'opencode run' commands inside user-specified workdirs (including background tasks). That legitimately requires filesystem access to the project, but is open-ended and can cause arbitrary code and file modifications. Additionally, a pre-scan detected unicode-control-chars (prompt-injection pattern) inside SKILL.md, which is concerning because it could be an attempt to manipulate the agent's behavior or evade reviewers.

Install Mechanism

There is no install spec and no code files — this is instruction-only, which is low-risk from an install perspective. The README suggests installing opencode via npm, but the skill itself does not attempt to download or run installers.

Credentials

The skill declares no required environment variables or credentials. That is proportionate for a CLI-based coding helper. Note: running the recommended 'npm install -g opencode' requires network and package-manager privileges, so verify the OpenCode package source before installing.

Persistence & Privilege

always is false and the skill is user-invocable; autonomous invocation is allowed (platform default) but not by itself a red flag. The skill does not request persistent system-wide privileges or attempt to modify other skills' configs.

Scan Findings in Context

[unicode-control-chars] unexpected: Control/unicode-injection characters in an instruction-only SKILL.md are not expected for a straightforward CLI usage document. Such characters can be used to hide or manipulate instructions and may indicate a prompt-injection attempt or attempt to evade simple scanners. Treat this as a warning and inspect the raw SKILL.md for hidden characters and unexpected content.

What to consider before installing

This skill is coherent: it tells the agent to run the OpenCode CLI against code in a project directory, which matches its description. However, before installing or invoking it: (1) verify the origin and trustworthiness of both this skill and the OpenCode CLI package (npm package provenance, GitHub repo, maintainer). (2) Be aware that the skill's commands are open-ended and will modify files in the specified workdir — run it in a sandbox or branch, and ensure your project is under git so you can review diffs. (3) The SKILL.md contains unicode control characters detected by a scanner; inspect the raw file for hidden characters or unexpected instructions. (4) Avoid granting broad autonomous privileges: prefer to run the skill only when invoked manually, or restrict it to a test repository until you confirm behavior. (5) If you install opencode, prefer a vetted source (official registry/repo) and consider using a non-global install or container to limit impact.

Specialized coding agent skill optimized for software development tasks using OpenCode.

Quick Start

Basic Usage

# Simple task in your project
bash pty:true workdir:~/your-project command:"opencode run 'Add feature or fix bug'"

# Background task for complex work
bash pty:true workdir:~/your-project background:true command:"opencode run 'Build complete feature'"

Common Development Patterns

Bug Fixing

bash pty:true workdir:~/project command:"opencode run 'Fix the [specific issue] in [file/component]'"

Feature Development

bash pty:true workdir:~/project command:"opencode run 'Implement [feature name] with [requirements]'"

Code Refactoring

bash pty:true workdir:~/project background:true command:"opencode run 'Refactor [module] to improve [performance/readability/maintainability]'"

Testing

bash pty:true workdir:~/project command:"opencode run 'Add unit tests for [function/module] using [testing framework]'"

Best Practices

1. Always specify the work directory - keeps context focused
2. Use descriptive prompts - include file names, expected behavior, and constraints
3. Monitor background tasks - use process action:log to track progress
4. Git required - ensure your project is a git repository (OpenCode requirement)

Examples

Create React Component

bash pty:true workdir:~/my-app command:"opencode run 'Create a reusable Button component with variants (primary, secondary, danger), loading state, and TypeScript interface'"

API Development

bash pty:true workdir:~/backend command:"opencode run 'Add user registration endpoint with email validation, password hashing, and JWT token generation'"

Database Migration

bash pty:true workdir:~/project command:"opencode run 'Create database migration to add created_at and updated_at timestamps to all existing tables'"

Requirements

• OpenCode CLI installed (npm install -g opencode)
• Git repository for target project
• PTY support enabled (automatic with pty:true)