OpenCode AI

This skill appears coherent: it simply wraps an external 'opencode' CLI and documents how to use it. Before installing or running it, do the following: - Verify the opencode binary provenance: prefer 'brew install opencode' or an official release; avoid running untrusted binaries. Check the Homebrew formula or upstream project. - Because the skill lacks a homepage/source repo in the metadata, treat it as coming from an unknown author — inspect the code/documentation locally and confirm there are no unexpected scripts or network calls in the actual opencode binary. - Be cautious with server/share features: 'opencode run --share', 'opencode serve', 'web', 'acp', and 'attach <url>' can expose session contents or code to remote endpoints. Do not use them with sensitive code or credentials unless you trust the destination. - Installing into system locations (sudo cp/chown) modifies system directories and requires admin rights; only do so if you trust the package contents. Consider using a symlink/dev workflow instead of overwriting system files. - Confirm where opencode stores provider credentials (opencode auth/providers). Ensure secrets are stored as you expect (e.g., OS keyring) and not written to the skill folder you are copying. If you want higher confidence, obtain the upstream source (homepage or repo), audit the opencode binary or Homebrew formula, and confirm the skill package was published by a known maintainer.