by waybarrios
54 rigorous skills for Codex, OpenCode, and Pi: code review, security audit, feature development, frontend design, MCP tools, Hugging Face ML/training, and more.
# Add to your Claude Code skills
git clone https://github.com/waybarrios/opencode-power-packGuides for using ai agents skills like opencode-power-pack.
Last scanned: 5/27/2026
{
"issues": [],
"status": "PASSED",
"scannedAt": "2026-05-27T08:04:10.623Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}See how opencode-power-pack compares with popular alternatives.
opencode-power-pack is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by waybarrios. 54 rigorous skills for Codex, OpenCode, and Pi: code review, security audit, feature development, frontend design, MCP tools, Hugging Face ML/training, and more. It has 504 GitHub stars.
Yes. opencode-power-pack passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/waybarrios/opencode-power-pack" and add it to your Claude Code skills directory (see the Installation section above).
opencode-power-pack is primarily written in Python. It is open-source under waybarrios on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh opencode-power-pack against similar tools.
No comments yet. Be the first to share your thoughts!
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
See comparison
OpenCode Power Pack now includes an opt-in, fail-closed sandbox runner for safer command execution from Codex, OpenCode, Claude Code, and Pi. It gives all four agents one portable capability contract with four least-privilege profiles, while using native Seatbelt isolation on macOS and Bubblewrap on Linux.
observe, develop, network-read, or publish, with explicit escalation checks.Install the CLI, verify the boundary from the active agent session, and run a command with the skill's trusted profile:
npm install --global @waybarrios/opencode-power-pack@0.5.0
opencode-power-pack sandbox doctor --json
opencode-power-pack sandbox exec --skill code-review -- git status --short
The current guarantee is intentionally precise: the command and its descendants are shell-contained. Automatic host routing and whole-agent isolation are not claimed yet. See run the sandbox from each agent and the complete compatibility specification.
Run these commands inside Claude Code:
/plugin marketplace add waybarrios/opencode-power-pack
/plugin install opencode-power-pack@opencode-power-pack
Run /reload-plugins if the installation summary requests it. Skills are namespaced to avoid collisions, so explicit invocations use names such as /opencode-power-pack:code-review and /opencode-power-pack:feature-dev.
codex plugin marketplace add waybarrios/opencode-power-pack --ref main
codex plugin add opencode-power-pack@opencode-power-pack
Start a new Codex session, open /plugins to confirm the installation, or invoke a workflow explicitly with $code-review, $feature-dev, $security-review, and the other bundled skills.
pi install git:github.com/waybarrios/opencode-power-pack
Pi discovers the fifty-four skills declared by the package. Use pi list to verify the installation. For a project-local installation recorded in .pi/settings.json, add -l:
pi install git:github.com/waybarrios/opencode-power-pack -l
Install only the workflows you want into the shared .agents/skills location recognized by Codex, OpenCode, and Pi:
Use npx when you want to run the latest installer without keeping a global copy:
# Inspect every profile and skill
npx @waybarrios/opencode-power-pack list
# Install the balanced recommended profile for your user
npx @waybarrios/opencode-power-pack install --profile recommended
# Install individual skills
npx @waybarrios/opencode-power-pack install code-review security-review
# Install a profile only for the current repository
npx @waybarrios/opencode-power-pack install --profile review --project
# Preview a selection without writing anything
npx @waybarrios/opencode-power-pack install --profile security --dry-run
# Update previously copied skills from the latest package
npx @waybarrios/opencode-power-pack@latest install --profile review --force
Or install the package globally and use its shorter executable:
npm install --global @waybarrios/opencode-power-pack
opencode-power-pack list
opencode-power-pack install --profile recommended
opencode-power-pack install code-review security-review
To update or remove the global installation:
npm update --global @waybarrios/opencode-power-pack
npm uninstall --global @waybarrios/opencode-power-pack
The npm package is scoped as @waybarrios/opencode-power-pack to give it an unambiguous registry identity. The package still installs the shorter opencode-power-pack executable for direct CLI use. No global installation is required when using npx.
Every GitHub release can also be published from its immutable tag to the repository's GitHub Packages page. npmjs remains the recommended public installation source because it works without GitHub authentication.
To install the GitHub Packages mirror, first authenticate with a GitHub personal access token (classic) that has read:packages, then select the GitHub registry explicitly:
npm login --scope=@waybarrios --auth-type=legacy --registry=https://npm.pkg.github.com
npm install --global @waybarrios/opencode-power-pack --registry=https://npm.pkg.github.com
opencode-power-pack list
Run the installer directly from the mirror after authentication:
npx --registry=https://npm.pkg.github.com @waybarrios/opencode-power-pack list
Maintainers publish the mirror with the Publish GitHub Package workflow. Release events publish automatically, while a manual run requires an existing release tag such as v0.5.0. The workflow verifies that the tag matches package.json, uploads the artifact already verified by required release CI without rerunning lifecycle scripts, and authenticates with the repository-scoped GITHUB_TOKEN; no package token is stored in the repository.
| Profile | Intended use |
|---|---|
recommended |
Balanced software development without the specialized security and ML catalogs |
review |
Comprehensive and focused code review plus quality and differential review |
feature-dev |
End-to-end feature workflow with its explorer, architect, and reviewer dependencies |
frontend |
Frontend implementation and anti-generic design critique |
security |
Security review, threat modeling, static analysis, validation, and reporting |
huggingface |
Model discovery, local inference, training, evaluation, Spaces, and AWS deployment |
authoring |
Skill and MCP authoring plus technical-paper summarization |
project-memory |
Audit and maintain durable project guidance |
Profiles automatically include required companion skills and can be combined with individual skill names. The default destination is ~/.agents/skills; --project finds the current Git root and installs into its .agents/skills directory. Existing directories are skipped unless --force is provided, and replacements are staged with rollback plus per-skill locking. Every copied skill retains its provenance, third-party notices, and license texts. Use --dry-run to preview or --all to install the complete catalog.
The npm installer and the full Claude Code/Codex/OpenCode plugins are alternative activation paths. Claude Code users should prefer the namespaced plugin because the selective installer currently targets the portable .agents/skills location used by Codex, OpenCode, and Pi. If a full plugin is already active, selectively copying the same skills does not reduce that plugin's loaded catalog.
The package assigns every bundled skill a default least-capability profile and an explicit set of allowed escalations. Native plugin and package installations expose the skills but do not install the sandbox executable, so install the npm CLI in the same operating-system environmen