Opcode

Zero-token execution layer for AI agents. Define workflows once, run them free forever — persistent, scheduled, deterministic. 6 MCP tools over SSE. Supports DAG-based execution, 6 step types (action, condition, loop, parallel, wait, reasoning), 26 built-in actions, ${{}} interpolation, reasoning nodes for human-in-the-loop decisions, and secret vault. Use when defining workflows, running templates, checking status, sending signals, querying workflow history, or visualizing DAGs.

This package implements a full local workflow runtime that can execute shell commands, read/write files, and access the network — that's expected for its purpose but also high-risk if installed blindly. Key points before installing: (1) Registry metadata and the SKILL.md disagree — SKILL.md requires Go/toolchain and the OPCODE_VAULT_KEY secret (which the docs call 'root-equivalent'), so do not trust the registry's 'no env vars' claim. (2) The install instructions run `go install` to fetch/build code from GitHub and the runtime downloads a helper binary into ~/.opcode — inspect the GitHub repository and release history before running that command. (3) Default configuration is permissive (no deny-lists, open network egress); if you proceed, run the daemon under a dedicated low-privilege user, set DenyPaths/WritablePaths, restrict outbound network (proxy/firewall), enable the least-privilege settings, and do not put OPCODE_VAULT_KEY into settings.json. (4) If you cannot audit the upstream repo or do not want a persistent local daemon with a secrets vault, consider running in an isolated VM/container or avoid installing. Additional information that would increase confidence: a verified homepage/repository owner, a release tag/commit to inspect, and registry metadata that matches SKILL.md requirements.

Type: OpenClaw Skill Name: opcode Version: 1.2.2 The OpenClaw AgentSkills bundle for 'opcode' is classified as suspicious due to its inherent high-risk capabilities, which, while intended for an automation engine, create significant attack surface. The `shell.exec` action (documented in SKILL.md and references/actions.md) allows arbitrary command execution, effectively providing Remote Code Execution (RCE) primitive. Similarly, `fs.*` actions grant broad filesystem access, and `http.*` actions enable arbitrary network requests. The documentation (references/operations.md) explicitly states that the default security model is permissive for filesystem and network access, meaning these powerful capabilities are enabled by default without explicit hardening. While there is no evidence of intentional malice in the provided files (e.g., no prompt injection against the agent, no direct exfiltration commands), the combination of these features makes the skill a critical vulnerability vector if workflows are not carefully designed or if they process untrusted input.