opencode — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited opencode (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This is an executable protocol for delegating work to OpenCode agents. Follow it precisely.
opencode CLI installed and in PATH (verify: opencode --version)opencode providers list)opencode modelsOPENCODE_DISABLE_AUTOUPDATE=true opencode run --format json --model <provider/model> --agent <build|plan> --dir "<working-dir>" --dangerously-skip-permissions [options] "<prompt>" 2>/dev/nullKey flags:
--format json -- machine-parseable ndjson output (always use this)--model provider/model -- e.g., openai/gpt-5.4, openai/gpt-5.3-codex--variant <level> -- reasoning effort: minimal, medium, high, xhigh (provider-specific)--dir <path> -- working directory for the task--dangerously-skip-permissions -- auto-approve tool calls (required for headless)-f/--file <path> -- attach file(s) to the prompt--agent <name> -- build for implementation (filesystem+bash), plan for analysis (read-only)-c/--continue -- continue last session-s/--session <id> -- continue specific sessionThe --format json flag emits ndjson (one JSON object per line):
| type | Contains |
|---|---|
text | .part.text -- model's text response |
tool_call | .part.name, .part.input -- tool invocations |
tool_result | .part.output -- tool execution results |
step_start | Session/message IDs |
step_finish | .part.tokens (usage), .part.cost, .part.reason |
Parse with the helper script (always redirect stderr):
opencode run --format json ... 2>/dev/null | python .claude/skills/opencode/scripts/parse_output.py [--mode text|full|tools|cost|session|diff|summary]Parse modes:
text -- model's text response (default)full -- text + tool calls + tool resultstools -- tool calls and results onlycost -- token usage and cost breakdownsession -- extract session ID for continuationdiff -- extract file modifications from tool callssummary -- one-line summary (status, tokens, cost, duration)Determine the task type from the user's request, then follow the matching protocol.
Use when the user wants OpenCode to write or modify code.
Steps:
-f.--agent build: OPENCODE_DISABLE_AUTOUPDATE=true opencode run --format json \
--model openai/gpt-5.4 --agent build \
--dir "C:/UnrealEngine/VHS" --dangerously-skip-permissions \
-f <file1> -f <file2> \
"<prompt>" 2>/dev/null | python .claude/skills/opencode/scripts/parse_output.py --mode fullDefault model: openai/gpt-5.4 | Timeout: timeout: 300000
Use when the user wants a second opinion on code quality, bugs, or correctness.
Steps:
--agent plan (read-only): OPENCODE_DISABLE_AUTOUPDATE=true opencode run --format json \
--model openai/gpt-5.4 --variant high --agent plan \
--dir "C:/UnrealEngine/VHS" --dangerously-skip-permissions \
-f <file1> "<review prompt>" 2>/dev/null | python .claude/skills/opencode/scripts/parse_output.pyDefault model: openai/gpt-5.4 + --variant high | Timeout: timeout: 300000
Use when the user wants OpenCode to investigate a bug or error.
Steps:
--agent plan: OPENCODE_DISABLE_AUTOUPDATE=true opencode run --format json \
--model openai/gpt-5.3-codex --variant high --agent plan \
--dir "C:/UnrealEngine/VHS" --dangerously-skip-permissions \
"<diagnostic prompt>" 2>/dev/null | python .claude/skills/opencode/scripts/parse_output.pyDefault model: openai/gpt-5.3-codex + --variant high | Timeout: timeout: 300000
Use when the user wants OpenCode to explore and analyze the codebase.
Steps:
--agent plan: OPENCODE_DISABLE_AUTOUPDATE=true opencode run --format json \
--model openai/gpt-5.4-mini-fast --agent plan \
--dir "C:/UnrealEngine/VHS" --dangerously-skip-permissions \
"<research question>" 2>/dev/null | python .claude/skills/opencode/scripts/parse_output.pyDefault model: openai/gpt-5.4-mini-fast | Timeout: timeout: 300000
These patterns compose the basic protocols above into more powerful workflows. Use them when the task benefits from multi-step validation or parallel execution.
When: Implementation tasks where quality matters. This is the default for non-trivial implementation.
Protocol:
--agent buildopenai/gpt-5.4, review with openai/gpt-5.3-codexWhen: The user wants thorough validation, or says "get multiple opinions".
Protocol:
run_in_background or &): # Run in parallel -- each to a temp file
PROMPT="<review prompt>"
DIR="C:/UnrealEngine/VHS"
OPENCODE_DISABLE_AUTOUPDATE=true opencode run --format json \
--model openai/gpt-5.4 --variant high --agent plan \
--dir "$DIR" --dangerously-skip-permissions "$PROMPT" \
2>/dev/null > /tmp/review_gpt54.txt &
OPENCODE_DISABLE_AUTOUPDATE=true opencode run --format json \
--model openai/gpt-5.3-codex --variant high --agent plan \
--dir "$DIR" --dangerously-skip-permissions "$PROMPT" \
2>/dev/null > /tmp/review_codex.txt &
wait cat /tmp/review_gpt54.txt | python .claude/skills/opencode/scripts/parse_output.py
cat /tmp/review_codex.txt | python .claude/skills/opencode/scripts/parse_output.pyWhen: The user wants iterative code improvement, or says "keep improving this", "optimize", "polish".
Inspired by autoresearch's iterative experiment loop. The agent makes changes, validates them, keeps improvements, and reverts failures.
Protocol:
LOOP (max N iterations, default 3):
1. Identify the current quality baseline (read code, note issues)
2. Construct an improvement prompt targeting the worst issue
3. Run Protocol 1 (Implement) with --agent build
4. Validate: read changed files, check for regressions
5. Run Protocol 2 (Review) on changed files with a different model
6. QUALITY GATE:
- If review passes (no critical issues) → keep changes, report improvement
- If review fails (critical issues found) → revert changes (git checkout the files), report why
7. If no more meaningful improvements found → STOP
8. Continue to next iterationImportant constraints:
When: Claude Code wants to continue other work while OpenCode runs. Use for long-running tasks that don't block the conversation.
Protocol:
run_in_background: true: OPENCODE_DISABLE_AUTOUPDATE=true opencode run --format json \
--model openai/gpt-5.4 --agent plan \
--dir "C:/UnrealEngine/VHS" --dangerously-skip-permissions \
"<prompt>" 2>/dev/null > /tmp/opencode_result.txt cat /tmp/opencode_result.txt | python .claude/skills/opencode/scripts/parse_output.pyWhen: Complex tasks that benefit from building context across multiple exchanges.
Protocol:
OPENCODE_DISABLE_AUTOUPDATE=true opencode run --format json \
--model openai/gpt-5.4 --agent plan \
--dir "C:/UnrealEngine/VHS" --dangerously-skip-permissions \
"<first task>" 2>/dev/null | tee /tmp/oc_step1.txt | python .claude/skills/opencode/scripts/parse_output.py --mode session OPENCODE_DISABLE_AUTOUPDATE=true opencode run --format json \
--session "<session-id>" --dangerously-skip-permissions \
"<follow-up task>" 2>/dev/null | python .claude/skills/opencode/scripts/parse_output.pyOr use --continue for the last session:
OPENCODE_DISABLE_AUTOUPDATE=true opencode run --format json \
--continue --dangerously-skip-permissions \
"<follow-up task>" 2>/dev/null | python .claude/skills/opencode/scripts/parse_output.pyWhen: Risky implementations where rollback safety is important.
Inspired by autoresearch's git-as-state-machine pattern.
Protocol:
git stash # or commit current work--agent build git checkout -- <modified-files>OpenCode has NO access to this conversation's context. Every prompt must be fully self-contained.
Do NOT use OpenCode to invoke Claude/Anthropic models or Google/Gemini models -- these providers are not available in OpenCode. Only use OpenAI, GitHub Copilot, local, and OpenCode's own models.
Every prompt sent to OpenCode must follow this structure:
[CONTEXT BLOCK]
<project type, conventions, key constraints>
[TASK]
<imperative description of what to do>
[SCOPE]
<explicit boundaries: which files/dirs to touch, which to ignore>
[CONSTRAINTS]
<naming conventions, patterns to follow, things to avoid>
[OUTPUT FORMAT]
<what form the response should take>This is an Unreal Engine 5.7 C++ project (VHS - first-person horror game).
Source: Source/VHS/ | Module: VHS | No Public/Private split (side-by-side .h/.cpp)
Naming conventions:
- UE prefixes: A (actors), U (UObjects), F (structs), E (enums), I (interfaces)
- GAS: GA_ (abilities), GC_ (cues), MMC_ (magnitude calcs), GE_ (effects)
- Booleans: b prefix (bIsRecovering)
- #pragma once, CoreMinimal.h first, .generated.h last
Key systems: GAS (AbilitySystem/), Enhanced Input, StateTree (AI)
Dependencies: GameplayAbilities, GameplayTags, GameplayTasks, EnhancedInput, StateTreeModuleAlways set explicit scope boundaries. Broad prompts cause the agent to explore the entire filesystem and timeout.
Good:
Search ONLY in Source/VHS/AbilitySystem/. Do NOT explore other directories.
Modify ONLY HorrorCharacter.h and HorrorCharacter.cpp. Do NOT touch other files.Bad:
Look through the project and find issues. (too broad -- will timeout)[CONTEXT]
This is an Unreal Engine 5.7 C++ project (VHS). <conventions block>
[TASK]
Implement <feature> in <file(s)>.
<detailed requirements>
[SCOPE]
- Create/modify ONLY: <explicit file list>
- Reference (read-only): <files to read for context>
- Do NOT touch: <exclusions>
[CONSTRAINTS]
- Follow existing patterns in <reference file>
- Use UPROPERTY(EditDefaultsOnly, Category = "<Category>") for configurable values
- All new UObject classes need UCLASS(ClassGroup=(VHS)) macro
- Header: #pragma once, CoreMinimal.h first, .generated.h last
[OUTPUT]
Write the implementation directly. No explanations needed.[CONTEXT]
This is an Unreal Engine 5.7 C++ project using GAS. <conventions block>
[TASK]
Review the following files for: correctness, bugs, performance, security, UE5 best practices.
Be specific: cite file paths and line numbers. Suggest concrete fixes.
[SCOPE]
Review ONLY: <file list>
Do NOT explore other directories.
[OUTPUT FORMAT]
For each issue found:
- **[SEVERITY]** (critical/warning/info)
- **File:Line** -- specific location
- **Issue** -- what's wrong
- **Fix** -- concrete solution[CONTEXT]
UE5.7 project (VHS) using GAS. <conventions block>
[BUG REPORT]
<symptom description>
<error messages / stack traces>
<reproduction steps if known>
[TASK]
Investigate root cause. Check:
- <specific things to check based on the bug>
- For GAS bugs: tag blocking, effect ordering, MMC deps, ASC init timing
[SCOPE]
Search ONLY in: <directory>
[OUTPUT FORMAT]
1. Root cause (most likely)
2. Evidence (file:line references)
3. Fix (concrete code changes)Pick the right model for the task. See references/models.md for the full guide.
Quick defaults:
| Task | Fast | Default | Deep |
|---|---|---|---|
| Implementation | openai/gpt-5.4-mini-fast | openai/gpt-5.4 | openai/gpt-5.3-codex |
| Review | openai/gpt-5.4-mini | openai/gpt-5.4 + --variant high | openai/gpt-5.3-codex + --variant high |
| Debug | openai/gpt-5.4-mini-fast | openai/gpt-5.3-codex + --variant high | openai/gpt-5.4 + --variant xhigh |
| Research | openai/gpt-5.4-mini-fast | openai/gpt-5.4-fast | openai/gpt-5.4 |
Use opencode models to discover all available models. Only OpenAI, GitHub Copilot, OpenCode's own free-tier models, and local models (Ollama/LM Studio) are supported.
Cross-model review pairings (for Pipeline Pattern A):
openai/gpt-5.4 → Review with openai/gpt-5.3-codexopenai/gpt-5.3-codex → Review with openai/gpt-5.4Cost-sensitive alternatives:
github-copilot/gpt-5.4 -- free with Copilot subscriptiongithub-copilot/gpt-5.3-codex -- free with Copilot subscriptionopencode/big-pickle -- OpenCode's own free tierollama/qwen3-coder:latest -- zero API cost| Symptom | Cause | Recovery |
|---|---|---|
opencode not found | Not installed | Tell user: npm i -g opencode |
| No providers configured | No auth | Tell user: opencode providers login |
| Model not available | Wrong model ID | Run opencode models, suggest alternatives |
| Timeout (>3 min) | Scope too broad | Narrow scope constraints, use faster model |
| JSON parse failure | Corrupt output | Retry with --format default, read raw text |
| Exit code non-zero | Runtime error | Check stderr (up to 500 chars), retry once |
| Empty text response | Agent did only tool calls | Use --mode full to see tool call results |
If a model fails or times out, fall back in this order:
openai/gpt-5.4 (primary)openai/gpt-5.3-codex (code-optimized)openai/gpt-5.4-mini-fast (fastest, always works)github-copilot/gpt-5.4 (free tier)opencode/big-pickle (OpenCode free tier)If OpenCode crashes mid-implementation (--agent build):
git diff --name-onlygit checkout -- <files>Use this to decide WHEN and HOW to invoke OpenCode:
User request received
│
├─ "use opencode" / names a model → Use OpenCode (user explicit)
│
├─ "second opinion" / "cross-validate" → Pattern B (Parallel Multi-Model)
│
├─ "implement with X" → Protocol 1, optionally Pattern A (Implement-Then-Review)
│
├─ "review with X" → Protocol 2
│
├─ "keep improving" / "optimize" / "polish" → Pattern C (Autonomous Loop)
│
├─ Complex implementation → Pattern A (Implement-Then-Review) by default
│
├─ Risky changes → Pattern F (Git-Checkpoint)
│
└─ Long-running task, user wants to continue chatting → Pattern D (Background)See references/advanced.md for:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.