Skip to content
    ↑↓ select↵ openesc close
    English中文
    tjvjk

    Policy

    v0.1.4Other
    opencode-policy

    OpenCode plugin for blocked file patterns and prompt injection policies

    Actively maintained
    #opencode#opencode-plugin#plugin#security#prompt-injection
    GitHub reponpm pageHomepage
    GitHub stars

    20

    Monthly installs

    47

    9 in 7 days

    Composite scoreSCORE

    34.9

    Multi-signal model

    Last commit

    3 months ago

    2026-04-24

    Install and configure

    opencode.json

    Writes to this project's opencode.json — applies to this repository only.

    opencode.json

    {
  "$schema": "https://opencode.ai/config.json",
  "plugin": ["opencode-policy@0.1.4"]
}

    opencode loads npm dependencies through its embedded runtime on startup and caches them locally — no manual global install needed.

    README.md
    View original→

    OpenCode security plugin with:

    You can review the full rule sets there and add or remove patterns to fit your workspace.

    Unsafe tool patterns Unsafe tool patterns

    Prompt injection patterns Prompt injection patterns

    Use it when you want stronger workspace safety out of the box: it helps prevent secret exposure, exfiltration, unsafe shell execution, reverse shells, denial-of-service commands, cross-workspace access, and common instruction-override attacks. Matching events are logged to .opencode/opencode-policy.log for review.

    Simple install

    opencode plugin opencode-policy@latest --global

    Install from npm

    Install the package:

    npm install opencode-policy

    Then add it to one of these OpenCode config files:

    • ~/.config/opencode/opencode.json for your user
    • opencode.json in your project root for one project
    {
  "$schema": "https://opencode.ai/config.json",
  "plugin": ["opencode-policy"]
}

    License

    MIT

    Thanks

    Pattern research and source material were adapted in part from vakovalskii/topsha