
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
agentikit-opencode
Advanced tools
OpenCode plugin for Agentikit - search and show extension assets via the akm CLI.
OpenCode plugin for the Agentikit CLI. Registers tools that let your AI agent search, show, and manage extension assets from stash directories and registries.
Add to your OpenCode config (opencode.json):
{
"plugin": ["agentikit-opencode"]
}
| Tool | Description |
|---|---|
akm_search | Search the local stash, the registry, or both for tools, skills, commands, agents, scripts, and knowledge |
akm_registry_search | Search installable registry kits only and return installRef / installCmd results |
akm_show | Show a stash asset by its ref |
akm_index | Build or rebuild the search index |
akm_agent | Dispatch a stash agent:* into OpenCode using the stash prompt and metadata |
akm_cmd | Execute a stash command:* template in OpenCode via SDK session prompting |
akm_add | Install kits from npm, GitHub, git URLs, or local directories |
akm_list | List installed registry kits |
akm_remove | Remove an installed registry kit and reindex |
akm_update | Update one installed kit or all installed kits |
akm_clone | Clone an asset into the working stash or a custom destination for editing |
akm_config | Show or update akm configuration (stashDir, mountedStashDirs, etc.) |
akm_run | Execute a stash tool or script using its runCmd |
akm_submit | Submit assets or feedback to the registry |
Use either:
akm_search with source: "registry" or source: "both"akm_registry_search when you only want installable community kitsRegistry hits include installRef and installCmd, which can be passed directly to akm_add.
Use akm_agent after retrieving an agent ref from akm_search.
Inputs:
ref (optional): stash ref like agent:coach.mdquery (optional): resolve best matching stash agent when ref is omittedtask_prompt (required): user task to rundispatch_agent (optional): OpenCode agent name (defaults to general)as_subtask (optional): create child session (defaults to true)At least one of ref or query is required.
Behavior:
akm showprompt verbatim as OpenCode systemmodelHint when in provider/model formattoolPolicy when it maps to boolean tool flagsUse akm_cmd to execute stash command templates through the OpenCode SDK.
Inputs:
ref (optional): stash ref like command:review.mdquery (optional): resolve best matching stash command when ref is omittedarguments (optional): raw command arguments for $ARGUMENTS, $1, $2, etc.dispatch_agent (optional): OpenCode agent name (defaults to current agent)as_subtask (optional): create child session (defaults to false)At least one of ref or query is required.
The akm CLI must be installed and available on PATH. Install it from the agentikit repo.
# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/itlackey/agentikit/main/install.sh | bash
# PowerShell (Windows)
irm https://raw.githubusercontent.com/itlackey/agentikit/main/install.ps1 -OutFile install.ps1; ./install.ps1
The stash directory is resolved automatically via a three-tier fallback: AKM_STASH_DIR env var (optional override) → stashDir in config.json → platform default. Set it persistently with:
akm config set stashDir /abs/path/to/your-stash
Expected layout:
stash/
├── tools/ # executable scripts (.sh, .ts, .js, .ps1, .cmd, .bat)
├── scripts/ # general-purpose scripts (.py, .rb, .go, .pl, .php, .lua, .r, .swift, .kt)
├── skills/ # skill directories containing SKILL.md
├── commands/ # markdown files
├── agents/ # markdown files
└── knowledge/ # markdown files
Assets are resolved from three source types: working (local stash, read-write), mounted (read-only additional dirs via mountedStashDirs config), and installed (registry kits via akm add, read-only).
FAQs
OpenCode plugin for Agentikit - search and show extension assets via the akm CLI.
We found that agentikit-opencode demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.