Opencode Guide

ReviewAudited by ClawScan on May 10, 2026.

Overview

This skill has a coherent opencode workflow, but it includes broad shell execution and callback routing that could send task results to the wrong OpenClaw/QQ session.

Install only if you understand that this skill delegates code work to opencode, stores task results locally, and sends callback messages to an OpenClaw/QQ session. Before using it, replace the hard-coded session key, verify the callback target, and avoid the bash-c wrapper unless the command is fully trusted.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Task descriptions, status updates, and possibly result summaries could be sent to the wrong chat/session if the agent follows the example literally.

Why it was flagged

The recommended command includes a concrete QQ/OpenClaw session key instead of a placeholder or runtime-selected current session, while the skill says completion notifications are sent through task-callback.sh.

Skill content

/home/root1/.openclaw/scripts/opencode-auto-callback.sh \
  "agent:main:qqbot:direct:1de7b85a1abc58fb6caebb5b9255a560"

Recommendation

Replace hard-coded session keys with a placeholder and require the agent or user to select the current session at runtime before sending callbacks.

Medium

#ASI05: Unexpected Code Execution

What this means

A malformed or malicious task command could execute unintended local commands, not just opencode.

Why it was flagged

The wrapper executes a caller-supplied command string through bash -c, which can run arbitrary shell commands if unsafe input is passed.

Skill content

OPENCODE_CMD="$3"
...
timeout "$TIMEOUT" bash -c "$OPENCODE_CMD --format json 2>&1" > "$JSON_OUTPUT"

Recommendation

Avoid bash -c for user-controlled command strings; invoke opencode with a fixed executable and validated argument array instead.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing or uninstalling the package can change files in the local OpenClaw scripts directory.

Why it was flagged

The package lifecycle copies helper scripts into the OpenClaw script directory and removes matching files on uninstall; this is related to the skill purpose but not reflected in the install-spec metadata.

Skill content

"postinstall": "cp -r scripts/* ~/.openclaw/scripts/ 2>/dev/null || true",
"preuninstall": "rm -f ~/.openclaw/scripts/opencode-*.sh ~/.openclaw/scripts/README-opencode-callback.md 2>/dev/null || true"

Recommendation

Review the copied scripts before use, and declare these install-time file operations and required opencode/callback dependencies in metadata.

Low

#ASI06: Memory and Context Poisoning

What this means

Prompts, code details, error logs, or other sensitive task content may remain on disk after the task completes.

Why it was flagged

The script stores task arguments, logs, JSON output, and extracted results in persistent local files under ~/.openclaw/task-results/.

Skill content

RESULT_DIR="$HOME/.openclaw/task-results"
...
echo "参数: $@" >> "$LOG_FILE"
opencode run --format json "$@" > "$JSON_OUTPUT"

Recommendation

Avoid putting secrets in task prompts and periodically review or clean ~/.openclaw/task-results/ if it may contain sensitive project data.

Low

#ASI03: Identity and Privilege Abuse

What this means

Using the wrong session key can post task updates or results into the wrong conversation.

Why it was flagged

The workflow relies on local OpenClaw session identifiers to send callbacks. This is purpose-aligned, but those identifiers determine where agent messages are delivered.

Skill content

可以从 sessions.json 文件获取：
cat ~/.openclaw/agents/main/sessions/sessions.json | jq 'keys'

Recommendation

Treat session keys as sensitive routing identifiers and verify the target session before running callback scripts.