creating-opencode-plugins
Facilitates the creation of OpenCode plugins with structured event handling and JavaScript/TypeScript implementation patterns.
Install this skill
Security score
The creating-opencode-plugins skill was audited on Mar 4, 2026 and we found 16 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 114 | console.warn(`⚠️ Sensitive file edited: ${path}`); |
Template literal with variable interpolation in command context
| 128 | console.error(`🚫 Blocked ${action} operation on sensitive file: ${target}`); |
Template literal with variable interpolation in command context
| 160 | console.log(`▶️ Executing: ${command} ${args.join(' ')}`); |
Template literal with variable interpolation in command context
| 169 | await $`osascript -e 'display notification "Completed in ${duration}ms" with title "${tool}"'`; |
Template literal with variable interpolation in command context
| 172 | console.log(`✅ ${tool} completed in ${duration}ms`); |
Template literal with variable interpolation in command context
| 201 | const result = await $`eslint ${fix ? '--fix' : ''} .`; |
Template literal with variable interpolation in command context
| 213 | console.log(`🔧 Tool: ${event.data.tool}`); |
Template literal with variable interpolation in command context
| 343 | console.log(`Tool completed: ${result.tool}`); |
Access to hidden dotfiles in home directory
| 224 | | **Global** | `~/.config/opencode/plugin/` | All projects | Security policies, global utilities | |
Access to .env file
| 15 | - Intercepting file operations (prevent sharing .env files) |
Access to .env file
| 74 | "description": "Prevents sharing .env files", |
Access to .env file
| 97 | /\.env$/, |
Access to .env file
| 98 | /\.env\..+$/, |
Access to .env file
| 303 | data: { path: '.env', content: 'SECRET=123', timestamp: Date.now() } |
Access to .env file
| 310 | **Security**: Prevent accidental sharing of credentials (env-protection plugin blocks .env file reads) |
External URL reference
| 385 | **Documentation**: https://opencode.ai/docs/plugins/ |
Install this skill with one command
/learn @pr-pm/creating-opencode-plugins