audit

name	audit
description	Read-only analysis of global OpenCode configuration. Use to find broken settings, risky plugins, stale models, permission gaps, keybinding conflicts, and missing useful resources.

Audit OpenCode Config

Audit the user's global OpenCode configuration. This is read-only. Do not create, edit, install, remove, or delete anything.

Phase 1: Read global config

Read these paths if they exist:

1. ~/.config/opencode/AGENTS.md
2. ~/.config/opencode/opencode.json
3. ~/.config/opencode/tui.json
4. ~/.config/opencode/agents/
5. ~/.config/opencode/commands/
6. ~/.config/opencode/skills/
7. ~/.config/opencode/plugins/
8. ~/.config/opencode/themes/
9. ~/.config/opencode/tools/
10. ~/.claude/CLAUDE.md and ~/.claude/skills/ only for fallback context
11. ~/.agents/skills/ only for compatible skill context

Summarize ~/.local/share/opencode/ only if needed. Do not read large session contents unless asked. Do not print secrets.

Run safe diagnostics:

opencode --version 2>/dev/null || true
opencode auth list 2>/dev/null || true
opencode agent list 2>/dev/null || true
opencode mcp list 2>/dev/null || true
opencode models 2>/dev/null || true
which git gh node npm pnpm bun python python3 uv docker rg fd 2>/dev/null || true

Checklist

Report findings as OK, WARN, or FAIL.

Rules

• Does ~/.config/opencode/AGENTS.md exist?
• Is it under 120 lines?
• Does it contain project-specific commands that belong in a project AGENTS.md?
• Does it duplicate ~/.claude/CLAUDE.md instead of using one source of truth?
• Are referenced paths and tools real?

Runtime config

• Is opencode.json valid JSON or JSONC?
• Does it declare $schema: https://opencode.ai/config.json?
• Are model defaults present and available in opencode models?
• Are share, autoupdate, snapshot, compaction, and watcher settings intentional?
• Are instructions paths/globs real?
• Are provider options free of literal secrets?

TUI config

• Is tui.json valid JSON or JSONC?
• Does it declare $schema: https://opencode.ai/tui.json?
• Are theme and keybinds valid?
• Are there likely terminal conflicts, especially ctrl+c, ctrl+v, tab, shift+enter, ctrl+p, and arrow keys used for subagent navigation?

Permissions

• Is permission using current syntax instead of deprecated tools where possible?
• Are edit and bash intentionally allow, ask, or deny?
• Are .env reads denied except .env.example?
• Are external_directory rules focused on trusted paths?
• Are git commit, git push, package installation, and destructive shell commands protected when appropriate?

Agents

• List configured agents and their modes.
• Check required markdown agent frontmatter: description.
• Prefer permission over deprecated tools in new or edited agents.
• Check subagents for accidental write access when their purpose is review or analysis.

Commands

• List configured commands and descriptions.
• Check markdown command frontmatter and referenced agents.
• Flag custom commands that override built-ins unintentionally.
• Flag commands that inject shell output with !\command`` without obvious need.

Skills

• List global OpenCode, Claude-compatible, and agent-compatible skills.
• Check required frontmatter: name, description.
• Check that name matches the directory and uses lowercase hyphen syntax.
• Flag duplicate skills with overlapping names or purposes.

Plugins and custom tools

• List local plugins and npm plugins.
• Flag plugins that run shell commands, mutate files, inject environment variables, or add tools.
• Check whether local plugins import external packages without a reviewed package.json.
• Flag unpinned or unreviewed third-party npm plugins.

MCP and providers

• List configured MCP servers and auth status without secrets.
• Flag remote MCP servers with broad permissions.
• Flag stale or unused providers if credentials are loaded unintentionally.

Report format

# OpenCode Config Audit

## Summary
[1-2 sentences]

## FAIL Problems
- [specific issue + fix]

## WARN Suggestions
- [specific improvement + why]

## OK Working
- [specific working config]

## Next steps
1. [most important]
2. [second]
3. [third]

Only report what you actually checked. No generic advice.