oc-create-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oc-create-skill (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are initiating the OpenCode skill creation workflow. This process guides the user through an interactive interview to gather requirements, generates a properly formatted SKILL.md file, and validates the result.
IMPORTANT: You MUST use the AskUserQuestion tool for ALL questions to the user. Never ask questions through regular text output.
Text output should only be used for summaries, explanations, and presenting information.
Read the OpenCode platform overview and skill guide:
${CLAUDE_PLUGIN_ROOT}/references/platform-overview.md${CLAUDE_PLUGIN_ROOT}/references/skill-guide.mdStore the reference content internally for use throughout the workflow.
Gather requirements through a structured interview using AskUserQuestion.
Ask these questions using AskUserQuestion (max 4 per call):
Question 1 — Skill Name:
code-review, deploy-check)."Question 2 — Purpose:
Question 3 — User-Invocable:
/skill-name)?"Question 1 — Target Audience:
Question 2 — Variables:
Question 3 — Complexity:
If the user selected multi-phase or complex:
Question 1 — Phases:
Question 2 — Tools:
Question 1 — Location:
Question 2 — Additional metadata:
After completing the interview rounds, present a summary of the gathered requirements:
## Skill Summary
- **Name**: {name}
- **Description**: {generated from purpose + details}
- **User-invocable**: {yes/no}
- **Variables**: {list or "none"}
- **Phases**: {count and brief description}
- **Tools**: {tool set}
- **Location**: {path}Use AskUserQuestion to confirm:
If "Make changes", ask what to change and update accordingly.
Spawn the generator agent to create the skill file:
Task:
subagent_type: "agent-alchemy-opencode-tools:oc-generator"
prompt: |
Generate an OpenCode skill with these specifications:
Type: skill
Name: {name}
Description: {description}
User-invocable: {true/false}
Variables: {list of $VARIABLE placeholders}
Phases: {phase descriptions}
Tool guidance: {which tools to use/avoid}
Target path: {target directory}/skills/{name}/SKILL.md
IMPORTANT: The `name` field is REQUIRED in frontmatter. Set it to "{name}" (must match the directory name).
Reference guide: ${CLAUDE_PLUGIN_ROOT}/references/skill-guide.md
Template: ${CLAUDE_PLUGIN_ROOT}/references/templates/skill-template.md
Interview notes:
{all gathered requirements}Spawn the validator agent to check the generated file:
Task:
subagent_type: "agent-alchemy-opencode-tools:oc-validator"
prompt: |
Validate the following OpenCode artifact:
Type: skill
Path: {path to generated file}
Reference guide: ${CLAUDE_PLUGIN_ROOT}/references/skill-guide.mdIf validation fails with errors, fix the issues and re-validate.
Present the generated skill to the user:
/{name} in the OpenCode TUICRITICAL: Complete ALL 5 phases before finishing.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.