oc-tool-dev — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oc-tool-dev (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are initiating the unified OpenCode tool development workflow. This process triages what the user needs, detects dependencies between artifacts, builds an execution plan, and delegates to the existing type-specific skills — reusing their interview flows and generation logic.
IMPORTANT: You MUST use the AskUserQuestion tool for ALL questions to the user. Never ask questions through regular text output.
Text output should only be used for summaries, explanations, and presenting information.
This skill delegates to existing oc-create-* and oc-update-* skills. When executing a tool creation/update:
Read the OpenCode platform overview for general context:
${CLAUDE_PLUGIN_ROOT}/references/platform-overview.mdType-specific guides (skill-guide.md, agent-guide.md, command-guide.md) are loaded later by the delegated skill — do not load them here.
Gather high-level requirements through 3 questions using AskUserQuestion.
Question 1 — Action:
Question 2 — Tool Type:
Question 3 — Name & Description:
Ask an additional question to locate the existing artifact:
Question 4 — Locate Artifact:
If "Search workspace": search using the same discovery patterns as the oc-update-* skills:
Glob for .opencode/{type}s/*/SKILL.md (skills) or .opencode/{type}s/*.md (agents/commands)Glob for .claude/{type}s/*/SKILL.md or .claude/{type}s/*.mdGlob for .agents/{type}s/*/SKILL.md or .agents/{type}s/*.mdAskUserQuestion for selectionStore triage results: action, type, name, description, and optionally the artifact path.
Based on the primary tool type, ask targeted dependency questions using AskUserQuestion.
Question 1 — Custom Agent:
If "Yes": ask for the agent name and brief purpose via AskUserQuestion.
Question 2 — Supporting Command:
If "Yes": ask for the command name and brief purpose via AskUserQuestion.
Question 1 — Parent Skill:
If "Yes": ask for the skill name and purpose via AskUserQuestion.
Question 1 — Agent Routing:
If "Yes": ask for the agent name and purpose via AskUserQuestion.
Question — Related Updates:
If "Yes": gather the names and types of related tools.
If the user indicates no dependencies in all questions, skip directly to Phase 4.
Build and present the execution plan as a text summary:
## Tool Creation Plan
### Primary Tool
- **Type**: {Skill | Agent | Command}
- **Name**: {name}
- **Action**: {Create | Update}
- **Purpose**: {brief description}
### Dependencies (processed first)
1. {Type}: {name} — {Create | Update} — {brief purpose}
2. ...
(If no dependencies: "No dependencies — single artifact workflow.")
### Execution Order
1. {first dependency}
2. {second dependency}
3. {primary tool}Confirm the plan using AskUserQuestion:
If "Modify plan": ask what to change, update the plan, and re-confirm. If "Cancel": stop the workflow and inform the user.
Process each item in the plan, in dependency order (agents before skills, skills before commands that reference them).
Step 1 — Determine the target skill path:
| Action | Type | Skill Path |
|---|---|---|
| Create | Skill | ${CLAUDE_PLUGIN_ROOT}/skills/oc-create-skill/SKILL.md |
| Create | Agent | ${CLAUDE_PLUGIN_ROOT}/skills/oc-create-agent/SKILL.md |
| Create | Command | ${CLAUDE_PLUGIN_ROOT}/skills/oc-create-command/SKILL.md |
| Update | Skill | ${CLAUDE_PLUGIN_ROOT}/skills/oc-update-skill/SKILL.md |
| Update | Agent | ${CLAUDE_PLUGIN_ROOT}/skills/oc-update-agent/SKILL.md |
| Update | Command | ${CLAUDE_PLUGIN_ROOT}/skills/oc-update-command/SKILL.md |
Step 2 — Read the target skill's SKILL.md.
Step 3 — Follow the loaded skill's instructions with these adjustments:
Step 4 — After each artifact completes:
Present a brief completion notice:
✓ {Type} "{name}" — {created | updated} at {path}Then proceed to the next item in the plan.
After all items are processed, present a final summary:
## Tool Creation Summary
### Artifacts
| # | Type | Name | Action | Path | Validation |
|---|------|------|--------|------|------------|
| 1 | {type} | {name} | {Created/Updated} | {path} | {Pass/Warnings} |
| 2 | ... | ... | ... | ... | ... |
### Dependencies
- {name} (agent) ← used by → {name} (skill)
- {name} (agent) ← routed from → {name} (command)
(If no dependencies: "All artifacts are independent.")
### Invocation
- Skill: `/{skill-name}` in the OpenCode TUI
- Agent: `@{agent-name}` in the TUI or `task({ command: "{agent-name}" })`
- Command: `/{command-name}` in the TUICRITICAL: Complete ALL 6 phases before finishing.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.