oc-update-command — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oc-update-command (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are initiating the OpenCode command update workflow. This process locates an existing command, researches current platform best practices, analyzes the command for issues, and applies updates with validation.
IMPORTANT: You MUST use the AskUserQuestion tool for ALL questions to the user. Never ask questions through regular text output.
Read the OpenCode platform overview and command guide:
${CLAUDE_PLUGIN_ROOT}/references/platform-overview.md${CLAUDE_PLUGIN_ROOT}/references/command-guide.mdFind the command to update.
If $ARGUMENTS is provided:
{name}.md in known directoriesIf no arguments:
Glob for .opencode/commands/*.mdGlob for ~/.config/opencode/commands/*.mdAskUserQuestion:Read the selected command file and store its contents.
Spawn the researcher agent to check latest documentation:
Task:
subagent_type: "agent-alchemy-opencode-tools:oc-researcher"
prompt: |
Research the latest OpenCode documentation for command format compatibility.
Artifact type: command
Current artifact content:
---
{contents of the command file}
---
Specific questions:
1. Are there any new command frontmatter fields?
2. Has the $VARIABLE system changed?
3. Are there new command discovery paths?
4. Any changes to the model override behavior?
Reference guide: ${CLAUDE_PLUGIN_ROOT}/references/command-guide.mdCompare the existing command against current best practices:
| Issue | Detection | Fix |
|---|---|---|
| Wrong model format | Must be provider/model-id if present | Convert format |
| Skill-only frontmatter | Fields like user-invocable, name, allowed-tools | Remove |
Missing description | Should have for command listing | Add |
Unknown agent value | If agent field present, agent must exist | Verify or remove |
subtask type | Must be boolean if present | Fix type |
| Issue | Detection | Fix |
|---|---|---|
| Inconsistent $VARIABLEs | Mixed case or invalid patterns | Standardize to uppercase |
| Claude Code tool names | AskUserQuestion instead of question | Convert |
mcp__ format | Double-underscore MCP naming | Convert to single-underscore |
| Hardcoded paths | System-specific absolute paths | Convert to relative, $VARIABLE, or @filepath reference |
| Very long body | Commands should be concise workflow shortcuts | Suggest splitting into a skill |
| Missing shell injection | Could use ` !command ` for dynamic context | Suggest where appropriate |
| Issue | Detection | Fix |
|---|---|---|
| No clear steps | Unstructured instructions | Add numbered steps |
| Missing output specification | No description of expected output | Add output section |
| Unused variables | $VARIABLEs declared but never used in body | Remove or use |
Present the analysis:
## Update Analysis: {command-name}
### Errors (must fix)
{list}
### Warnings (should fix)
{list}
### Suggestions
{list}
### Research Notes
{findings}Use AskUserQuestion for approval:
Apply changes based on user selection:
Edit to modify the command fileSpawn the validator agent:
Task:
subagent_type: "agent-alchemy-opencode-tools:oc-validator"
prompt: |
Validate the following OpenCode artifact:
Type: command
Path: {path to updated file}
Reference guide: ${CLAUDE_PLUGIN_ROOT}/references/command-guide.mdPresent validation results and a before/after summary.
CRITICAL: Complete ALL 7 phases before finishing.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.