Dispatch coding tasks to OpenCode or Claude Code on Perry workspaces. Use for development work, PR reviews, or any coding task requiring an isolated environment.
Security Analysis
high confidenceThe skill's instructions match its stated purpose (dispatch coding tasks to remote Perry workspaces) but omit and contradict important operational requirements (missing required binaries and secret/token handling) and recommend insecure SSH options—these mismatches warrant caution before installing.
The name/description (dispatch coding tasks to OpenCode/Claude on Perry workspaces) aligns with the SKILL.md instructions which show SSH-based dispatch to remote workspaces and running opencode/claude binaries. However, the skill declares no required binaries or credentials while the instructions clearly rely on local tools (tailscale, jq, curl, ssh) and a webhook token; this omission is an inconsistency.
Runtime instructions tell the agent to run ssh to remote hosts, run remote binaries, and instruct the remote to POST back to a local wake endpoint (http://${WAKE_IP}:18789). They also instruct use of 'tailscale status' to read local Tailscale IPs and to disable SSH host-key checking. These steps access local networking state and require a hook token (Authorization: Bearer <hooks-token>) that is not declared—this extends scope beyond a simple dispatcher and can expose a local HTTP endpoint to remote agents.
There is no install spec and no code files—this instruction-only skill does not write code to disk or download external packages, which is the lower-risk model for skills. However, reliance on external CLI tools (ssh, tailscale, jq, curl) is implied by the instructions.
The instructions require a webhook 'hooks-token' (Authorization: Bearer <hooks-token>) and implicitly require SSH credentials and access to the local Tailscale identity, but the skill declares no required environment variables, primary credential, or config paths. That mismatch (undeclared secrets and credentials) is a significant proportionality problem: the skill is asking you to use secrets but doesn't document them or how they should be provided/stored.
The skill does not request persistent presence (always:false) and does not include installation steps that modify agent/system config. It does depend on running background ssh processes but does not itself modify other skills or global settings.
Guidance
This skill appears to do what it says (dispatch remote coding agents), but there are several red flags you should address before installing or using it: - Missing declared requirements: The SKILL.md assumes local tools (tailscale, jq, ssh, curl) and a webhook token but the skill metadata declares none. Confirm these prerequisites and provide them securely. - Undeclared secret: The instructions require an Authorization: Bearer <hooks-token> value. Ask the author to declare required env vars (e.g., PERRY_HOOKS_TOKEN) or explain how tokens are provisioned. Never paste secrets into a skill without understanding storage/use. - Insecure SSH option: The examples use -o StrictHostKeyChecking=no which disables host key verification and increases MITM risk. Prefer adding known host keys or using a secure SSH config rather than disabling checking. - Local HTTP callback risk: Remote workspaces are instructed to POST back to your local IP:18789. Ensure that the wake endpoint is bound only to a safe interface, is authenticated, and is not exposed to untrusted networks. Consider firewall/Tailscale ACLs to limit who can reach that port. - Remote code execution: The skill runs arbitrary commands on remote workspaces via SSH. Only use with workspaces and keys you fully trust. Review remote binaries paths (/home/workspace/.opencode/, /home/workspace/.local/bin/claude) and confirm they are the intended agents. What would reduce my concern: explicit metadata listing required binaries and environment variables (including hook token), instructions that avoid disabling host-key checking, and clear guidance on securing and scoping the local wake endpoint. If the author provides those clarifications, the skill would look coherent and likely benign; until then treat it cautiously.
Latest Release
v1.5.0
Emphasized: always create dex task BEFORE dispatch
More by @gricha
Published by @gricha on ClawHub
