Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pr-pm/prpm --skill creating-opencode-pluginsgit clone --depth 1 https://github.com/pr-pm/prpmWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pr-pm/prpm/creating-opencode-plugins)<a href="https://agentmods.dev/skills/pr-pm/prpm/creating-opencode-plugins"><img src="https://agentmods.dev/badge/skills/pr-pm/prpm/creating-opencode-plugins/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pr-pm/prpm/creating-opencode-plugins"><img src="https://agentmods.dev/badge/skills/pr-pm/prpm/creating-opencode-plugins.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 15 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 74 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 310 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 303 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Excessive Agency · line 18 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.02478 |
| Opus 5.5 | $0.00024 | $0.00991 |
| Sonnet 5.5 | $0.00012 | $0.00496 |
| Haiku 4.5 | $0.00006 | $0.00248 |
Grade A, and why
creating-opencode-plugins scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 386 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Creating OpenCode Plugins
Overview
OpenCode plugins are JavaScript/TypeScript modules that hook into 25+ events across the OpenCode AI assistant lifecycle. Plugins export an async function receiving context (project, client, $, directory, worktree) and return an event handler.
When to Use
Create an OpenCode plugin when:
- Intercepting file operations (prevent sharing .env files)
- Monitoring command execution (notifications, logging)
- Processing LSP diagnostics (custom error handling)
- Managing permissions (auto-approve trusted operations)
- Reacting to session lifecycle (cleanup, initialization)
- Extending tool capabilities (custom tool registration)
- Enhancing TUI interactions (custom prompts, toasts)
Don't create for:
- Simple prompt instructions (use agents instead)
- One-time scripts (use bash tools)
- Static configuration (use settings files)
Quick Reference
Plugin Structure
export const MyPlugin = async (context) => {
// context: { project, client, $, directory, worktree }
return {
event: async ({ event }) => {
// event: { type: 'event.name', data: {...} }
switch(event.type) {
case 'file.edited':
// Handle file edits
break;
case 'tool.execute.before':
// Pre-process tool execution
break;
}
}
};
};
Event Categories
| Category | Events | Use Cases |
|---|---|---|
| command | command.executed |
Track command history, notifications |
| file | file.edited, file.watcher.updated |
File validation, auto-formatting |
| installation | installation.updated |
Dependency tracking |
| lsp | lsp.client.diagnostics, lsp.updated |
Custom error handling |
| message | message.*.updated/removed |
Message filtering, logging |
| permission | permission.replied/updated |
Permission policies |
| server | server.connected |
Connection monitoring |
| session | session.created/deleted/error/idle/status/updated/compacted/diff |
Session management |
| todo | todo.updated |
Todo synchronization |
| tool | tool.execute.before/after |
Tool interception, augmentation |
| tui | tui.prompt.append, tui.command.execute, tui.toast.show |
UI customization |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 386 lines · 59 tokens per session scan A 9c19f8fc9832
creating-opencode-plugins is a skill published in the GitHub repository pr-pm/prpm (123 stars, last pushed 2d ago), licensed MIT. It adds 59 tokens to every session and 2,478 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
best-practices
Transforms vague prompts into optimized Claude Code prompts. Adds verification, specific context, constraints, and proper phasing. Invoke with /best-practices.
testing-for-system-prompt-leakage
Extract and defend system prompts plus embedded secrets and routing logic.
writing-video-prompts
Writes the motion prompt for a video clip — what moves, how the camera behaves, the physics and the audio, in the shape the chosen model wants. Works from a brief alone, from a start frame, from a source video, or from a storyboard sheet where each panel becomes a cut. Handles one clip or a whole set, returning one…
red-teaming-llms-with-garak
Run NVIDIA garak probe suites against an LLM endpoint to test for jailbreaks, prompt injection, data leakage, and toxic generation, then interpret the hit-rate report for triage and reporting.
llm-prompt-optimizer
Use when improving prompts for any LLM. Applies proven prompt engineering techniques to boost output quality, reduce hallucinations, and cut token usage.
programasweights
Compile a natural-language spec into a tiny neural function that runs locally with ProgramAsWeights (PAW). Use it for fuzzy text-in / text-out tasks that a regex can't handle but that are too slow, costly, or overkill to send to a full LLM on every item - classify, categorize, label, or tag text (sentiment, urgency…