OpenCode Game Builder

This skill appears to be a legitimate coding subagent, but there are important mismatches and risks to consider before installing: - Source verification: there's no homepage or known source. Verify the OpenCode implementation (official repo or vendor) before trusting it. - Secrets and API keys: the documentation expects provider API keys but none are declared in the metadata. Do not put secrets in paths you allow the subagent to use; prefer scoped service accounts or ephemeral keys. - Filesystem exposure: the subagent can read/write files and run shell commands. When testing, use an isolated project directory (not your home or repositories containing credentials). - Session sharing / external links: the skill advertises shareable session links but doesn't name the hosting/service. Assume sharing may transmit code off-host; avoid using share features with proprietary code unless you confirm where shares go and how they are secured. - Operational controls: if possible, restrict autonomous invocation, review spawned subagent activity, and audit any created network endpoints. Ask the publisher for source code, a reproducible install, and details on session-sharing endpoints and privacy practices. If you can't verify the source and behavior, run OpenCode only from a trusted upstream repo or in a sandboxed environment. If you decide to proceed, monitor file and network activity and avoid exposing secrets.