Opencode Guide

协调并转达用户需求给 opencode 执行代码分析和修改，确保确认后异步使用自动回调脚本执行并汇报结果。

Before installing: - Expect the package to copy scripts into your home (~/.openclaw/scripts) during install. Review those scripts first. - The scripts expect an 'opencode' CLI and utilities (timeout, grep, sed); SKILL.md also suggests using jq to read sessions.json. The package metadata does not declare these — ensure you have them installed. - The scripts call /home/root1/.openclaw/scripts/task-callback.sh (absolute path) but that file is not included. Confirm where your task-callback.sh lives and edit the scripts to use $HOME or the correct path if needed. Hardcoded /home/root1 paths are fragile and could cause failures or unexpected behavior. - The workflow reads session data (~/.openclaw/agents/main/sessions/sessions.json) and passes session keys to a callback script to send notifications; sessions often contain sensitive tokens. Make sure you trust the callback mechanism and inspect task-callback.sh to verify it does not send these keys elsewhere. - The SKILL.md enforces an operational rule (“never run commands yourself, always delegate after user confirmation”), but that is an instruction only — the agent could still invoke the scripts autonomously. If you are concerned about autonomous modifications, restrict the agent's permissions or require explicit confirmation before any opencode run. If you proceed, audit and (if needed) patch the scripts to remove hardcoded paths, declare/verify dependencies, and confirm the callback implementation (task-callback.sh) is present and safe.

Type: OpenClaw Skill Name: opencode-guide Version: 1.0.0 The bundle provides a structured workflow and helper scripts (e.g., opencode-auto-callback.sh) designed to help an OpenClaw agent delegate code analysis and modification tasks to the 'opencode' tool. The instructions in SKILL.md emphasize user confirmation, asynchronous task management, and consistent communication, which are safety-oriented practices. While the scripts contain hardcoded paths (e.g., /home/root1/) and specific session IDs that appear to be artifacts from the author's environment, there is no evidence of malicious intent, data exfiltration, or unauthorized execution.