oc-create-command — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oc-create-command (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are initiating the OpenCode command creation workflow. This process guides the user through an interactive interview to gather requirements, generates a properly formatted command markdown file, and validates the result.
IMPORTANT: You MUST use the AskUserQuestion tool for ALL questions to the user. Never ask questions through regular text output.
Read the OpenCode platform overview and command guide:
${CLAUDE_PLUGIN_ROOT}/references/platform-overview.md${CLAUDE_PLUGIN_ROOT}/references/command-guide.mdGather requirements through a structured interview.
Question 1 — Command Name:
/{name}. Use kebab-case."Question 2 — Purpose:
Question 3 — Description:
Question 1 — Variables:
If "Yes":
Question 2 — Variable Names:
Question 3 — Model Override:
Question 4 — Agent Routing:
Question 1 — Location:
Present a summary:
## Command Summary
- **Name**: {name} (invoked as /{name})
- **Description**: {description}
- **Variables**: {list of $VARIABLE names or "none"}
- **Model override**: {model or "none"}
- **Agent**: {agent name or "none"}
- **Location**: {path}Use AskUserQuestion to confirm:
Spawn the generator agent:
Task:
subagent_type: "agent-alchemy-opencode-tools:oc-generator"
prompt: |
Generate an OpenCode command with these specifications:
Type: command
Name: {name}
Description: {description}
Variables: {list of $VARIABLE names}
Model override: {model or "none"}
Agent: {agent name or "none"}
Subtask: {true/false}
Purpose: {detailed purpose from interview}
Target path: {target directory}/commands/{name}.md
NOTE: Commands support `agent` (which agent executes) and `subtask` (force subagent execution) frontmatter fields in addition to `model` and `description`.
Reference guide: ${CLAUDE_PLUGIN_ROOT}/references/command-guide.md
Template: ${CLAUDE_PLUGIN_ROOT}/references/templates/command-template.md
Interview notes:
{all gathered requirements}Spawn the validator agent:
Task:
subagent_type: "agent-alchemy-opencode-tools:oc-validator"
prompt: |
Validate the following OpenCode artifact:
Type: command
Path: {path to generated file}
Reference guide: ${CLAUDE_PLUGIN_ROOT}/references/command-guide.mdIf validation fails with errors, fix and re-validate.
Present the generated command:
/{name} in the OpenCode TUICRITICAL: Complete ALL 5 phases before finishing.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.