oc-update-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oc-update-skill (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are initiating the OpenCode skill update workflow. This process locates an existing skill, researches current platform best practices, analyzes the skill for outdated patterns, and applies updates with validation.
IMPORTANT: You MUST use the AskUserQuestion tool for ALL questions to the user. Never ask questions through regular text output.
Read the OpenCode platform overview and skill guide:
${CLAUDE_PLUGIN_ROOT}/references/platform-overview.md${CLAUDE_PLUGIN_ROOT}/references/skill-guide.mdFind the skill to update.
If $ARGUMENTS is provided:
If no arguments:
Glob for .opencode/skills/*/SKILL.mdGlob for .claude/skills/*/SKILL.mdGlob for .agents/skills/*/SKILL.mdAskUserQuestion:Read the selected skill file and store its contents.
Spawn the researcher agent to check latest OpenCode documentation:
Task:
subagent_type: "agent-alchemy-opencode-tools:oc-researcher"
prompt: |
Research the latest OpenCode documentation for skill format compatibility.
Artifact type: skill
Current artifact content:
---
{contents of the skill file}
---
Specific questions:
1. Are there any new skill frontmatter fields since v1.2.10?
2. Have any existing fields been deprecated?
3. Are there new best practices for skill body structure?
4. Any changes to $VARIABLE placeholder handling?
Reference guide: ${CLAUDE_PLUGIN_ROOT}/references/skill-guide.mdCompare the existing skill against current best practices. Check for:
| Issue | Detection | Fix |
|---|---|---|
name field missing | Required — must match directory name | Add name: matching the parent directory |
name doesn't match directory | Name and directory must be identical | Fix to match |
allowed-tools present | Experimental field (Agent Skills spec) | Keep if intentional; note as experimental |
model field present | Not supported for skills | Remove; configure in opencode.json |
disable-model-invocation | Not supported | Remove |
argument-hint present | Not a valid OpenCode field | Remove; improve description |
arguments present | Not supported; use $VARIABLES | Remove; convert to $VARIABLE patterns |
Missing description | Required field | Add based on skill content |
| Description too vague | Should include trigger phrases | Improve with specific use cases |
| Issue | Detection | Fix |
|---|---|---|
| File-path skill references | Read .../SKILL.md patterns | Convert to skill({ name: "..." }) |
${CLAUDE_PLUGIN_ROOT} refs | Claude Code path variable | Remove; use name-based loading |
mcp__ tool names | Double-underscore MCP format | Convert to {name}_{tool} single-underscore |
Assumes question in subagent | Subagents can't use question | Restructure to gather info upfront |
| No phase markers | Complex skill without structure | Add numbered phases |
| Missing completion directive | No "complete ALL phases" note | Add critical completion note |
Apply any findings from the researcher agent:
Present the analysis results using text output, organized by severity:
## Update Analysis: {skill-name}
### Errors (must fix)
{list of errors with explanations}
### Warnings (should fix)
{list of warnings with explanations}
### Suggestions (consider)
{list of suggestions}
### Research Notes
{any findings from the researcher agent}Use AskUserQuestion to get user approval:
Based on user selection, apply the changes:
Edit to modify the skill fileSpawn the validator agent on the updated file:
Task:
subagent_type: "agent-alchemy-opencode-tools:oc-validator"
prompt: |
Validate the following OpenCode artifact:
Type: skill
Path: {path to updated file}
Reference guide: ${CLAUDE_PLUGIN_ROOT}/references/skill-guide.mdPresent the validation results. If errors remain, offer to fix them.
Show a before/after summary of the changes made.
CRITICAL: Complete ALL 7 phases before finishing.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.