Borrowing it
Nothing to install: this file belongs to zhanglongxiao111/indesign-cli. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zhanglongxiao111/indesign-cli/master/.codex/skills/using-opencode-cli/SKILL.mdgit clone --depth 1 https://github.com/zhanglongxiao111/indesign-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhanglongxiao111/indesign-cli/using-opencode-cli)<a href="https://agentmods.dev/skills/zhanglongxiao111/indesign-cli/using-opencode-cli"><img src="https://agentmods.dev/badge/skills/zhanglongxiao111/indesign-cli/using-opencode-cli/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhanglongxiao111/indesign-cli/using-opencode-cli"><img src="https://agentmods.dev/badge/skills/zhanglongxiao111/indesign-cli/using-opencode-cli.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 232 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.02825 |
| Opus 5.5 | $0.00022 | $0.01130 |
| Sonnet 5.5 | $0.00011 | $0.00565 |
| Haiku 4.5 | $0.00006 | $0.00282 |
Grade A, and why
using-opencode-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 266 lines — stays where its author put it; the contents beside it link to each section on GitHub.
调用 OpenCode CLI
核心规则
- 使用 PowerShell 7：
pwsh。不要用 Windows PowerShell 5.1。 - 默认模型：
deepseek/deepseek-v4-pro。 - 推理深度必须锁定：
--variant max。 - prompt 必须由 Codex 完全编写。脚本只原样传递，不自动拼接说明。
- OpenCode 作为子 agent 使用时，默认一轮一个命令。先读这一轮反馈，再决定是否继续。
- 同一专项、同一代码链路、同一计划的多轮任务，优先续同一个
sessionID。
DeepSeek Pro 有 1M 长上下文。相关任务不要频繁新开线程；上下文积累较多时，它通常更适合做大仓库、多文件、多轮复核。只有任务主题已经切换，或旧上下文会污染判断，才新开线程。想借旧上下文但不污染原线程时，用 --fork 或脚本的 -ForkSession。
模式选择
| 场景 | 模式 | 默认做法 |
|---|---|---|
| 单次正式调用、用户想看过程、可能人工接管 | 人工观察 | 脚本打开外部 Windows Terminal，可用 -Prompt 或 -TaskPath |
| 多轮持续调用、长时间审核、需要反复查询状态 | 脚本托管 | 后台运行，返回 RunDir，再按状态摘要查询 |
| 1-2 分钟短问、连通性测试 | 前台托管 | 原生 opencode run --format json，过滤后只打印 SESSION: 和正文 |
不要把三轮、五轮循环包进同一个 PowerShell 命令里。那样 Codex 不能基于上一轮反馈临场改下一轮提示词。
不要把前台托管用于正式长任务。Codex 的 shell 命令有外层等待限制，且长时间没有正文时看起来像“无输出”。单次正式调用默认用人工观察；需要多轮持续调用或长时间后台任务时，才用脚本托管；短问或连通性测试才用前台托管。
不要用顶层 TUI 入口 opencode [project] 作为观察模式。该入口当前命令行不接收 --variant，会导致推理深度不能锁定 max。
人工观察
这是单次正式调用的默认入口。人工观察会打开外部 Windows Terminal，并在 Codex 前台稀疏监控摘要。窗口里能看到 OpenCode 过程，用户也能接管。
直接提示词，适合“一句话 + 任务文档路径 + 临时补充”：
$repoRoot = (Get-Location).ProviderPath
$runner = Join-Path $repoRoot '.codex\skills\using-opencode-cli\scripts\run-opencode-task.ps1'
$prompt = @'
请读取这个任务文档并执行：docs/AI协作/本地Agent/进行中/[目录]/任务_[主题]_OpenCode.md
额外说明：这次只做交互式审核，先不要写输出文档，直接在当前会话说结论。
'@
& $runner -Prompt $prompt -RepoRoot $repoRoot -Mode observe
完整提示词文件：
$repoRoot = (Get-Location).ProviderPath
$taskPath = 'docs/AI协作/本地Agent/进行中/[目录]/任务_[主题]_OpenCode.md'
$runner = Join-Path $repoRoot '.codex\skills\using-opencode-cli\scripts\run-opencode-task.ps1'
& $runner -TaskPath $taskPath -RepoRoot $repoRoot -Mode observe
默认监控：
- 每 60 秒检查一次，最多 30 次。
- 只在内容变化时输出；长时间无变化时，每 5 次输出心跳。
- OpenCode 进入
session.idle后，前台监控会读取最后摘要并停止。 MaxUpdates只是防止无限等待的兜底。- 不保留完整导出 JSON。
常用参数：
# 调整监控频率
& $runner -Prompt $prompt -RepoRoot $repoRoot -Mode observe -WatchIntervalSeconds 90 -WatchMaxUpdates 20
# 只打开窗口，不让 Codex 自动监控
& $runner -Prompt $prompt -RepoRoot $repoRoot -Mode observe -NoWatch
# 续指定线程
& $runner -Prompt $prompt -RepoRoot $repoRoot -Mode observe -SessionId 'ses_xxx'
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 266 lines · 55 tokens per session scan A 1cc2b13cd7cd
using-opencode-cli is a skill published in the GitHub repository zhanglongxiao111/indesign-cli (59 stars, last pushed 1mo ago), licensed MIT. It adds 55 tokens to every session and 2,825 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
indd
Run InDesign ExtendScript (.jsx) on macOS by writing a script to a local file and executing it in Adobe InDesign via AppleScript (osascript). Use when the user wants to automate Adobe InDesign — create/modify documents, place images, build tables, export PDF/PNG/JPG/EPS, read fonts/styles/colors, convert IDML, or…
idml
Unpack and repack Adobe InDesign IDML files as editable XML, then edit the XML directly — no InDesign required. Use when the user wants to inspect, diff, or programmatically edit an .idml (stories/text, styles, colors, spreads, links) and produce a valid .idml back, or to convert between an .idml and its extracted…
feishu
Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.
interview
Ask one useful structured question at a time only when material product/implementation choices are genuinely missing; remember answers and produce a brief/spec. Discoverable facts should be investigated instead of asked.
recipe-create-meet-space
Create a Google Meet meeting space and share the join link.
refocusing
Use when a long-running agent may have lost the product outcome, when context was compacted, when work has crossed a major boundary, or when a fresh path-based trace is needed before the next consequential action. Not for fresh-session orientation, waking an idle seat, or checkpoints.