
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
akm-opencode
Advanced tools
OpenCode plugin for Agentikit - search and show extension assets via the akm CLI.
OpenCode plugin for the Agentikit CLI. Registers tools that let your AI agent search, show, and manage extension assets from stash directories and registries.
Add to your OpenCode config (opencode.json):
{
"plugin": ["akm-opencode"]
}
| Tool | Description |
|---|---|
akm_search | Search the local stash, the registry, or both for scripts, skills, commands, agents, and knowledge |
akm_registry_search | Search configured registries for installable kits and optional asset-level hits |
akm_show | Show a stash asset by its ref |
akm_index | Build or rebuild the search index |
akm_agent | Dispatch a stash agent:* into OpenCode using the stash prompt and metadata |
akm_cmd | Execute a stash command:* template in OpenCode via SDK session prompting |
akm_add | Install kits from npm, GitHub, git URLs, or local directories |
akm_list | List installed registry kits |
akm_remove | Remove an installed registry kit and reindex |
akm_update | Update one installed kit or all installed kits |
akm_clone | Clone an asset into the working stash or a custom destination for editing |
akm_config | Get, set, unset, list, or inspect akm configuration (including config path --all) |
akm_run | Execute a stash script using its run field |
akm_sources | List all resolved stash search paths |
akm_upgrade | Check for or install akm CLI updates |
Use either:
akm_search with source: "registry" or source: "both"akm_registry_search when you only want installable community kitsRegistry hits include id, installRef, and action fields. Use installRef when passing a result into akm_add; registry-specific IDs are not installable refs. Use assets: true when you also want asset-level matches from registry v2 indexes.
Use akm_agent after retrieving an agent ref from akm_search.
Inputs:
ref (optional): stash ref like agent:coach.mdquery (optional): resolve best matching stash agent when ref is omittedtask_prompt (required): user task to rundispatch_agent (optional): OpenCode agent name (defaults to general)as_subtask (optional): create child session (defaults to true)At least one of ref or query is required.
Behavior:
akm showprompt verbatim as OpenCode systemmodelHint when in provider/model formattoolPolicy when it maps to boolean tool flagsUse akm_cmd to execute stash command templates through the OpenCode SDK.
Inputs:
ref (optional): stash ref like command:review.mdquery (optional): resolve best matching stash command when ref is omittedarguments (optional): raw command arguments for $ARGUMENTS, $1, $2, etc.dispatch_agent (optional): OpenCode agent name (defaults to current agent)as_subtask (optional): create child session (defaults to false)At least one of ref or query is required.
When the plugin loads, it runs bun install -g akm-cli@latest so it always picks up the latest published npm package. It then prefers the Bun-installed binary and falls back to an existing akm on PATH when needed. It does not run the standalone shell installers automatically.
# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/itlackey/agentikit/main/install.sh | bash
# PowerShell (Windows)
irm https://raw.githubusercontent.com/itlackey/agentikit/main/install.ps1 -OutFile install.ps1; ./install.ps1
# Or via Bun
bun install -g akm-cli@latest
The stash directory is resolved automatically via a three-tier fallback: AKM_STASH_DIR env var (optional override) → stashDir in config.json → platform default. Set it persistently with:
akm config set stashDir /abs/path/to/your-stash
Expected layout:
stash/
├── scripts/ # executable scripts (.sh, .ts, .js, .ps1, .cmd, .bat, .py, .rb, .go, .pl, .php, .lua, .r, .swift, .kt)
├── skills/ # skill directories containing SKILL.md
├── commands/ # markdown files
├── agents/ # markdown files
└── knowledge/ # markdown files
Assets are resolved from three source types: working (local stash), search paths (additional dirs via searchPaths config), and installed (registry kits via akm add).
FAQs
OpenCode plugin for Agentikit - search and show extension assets via the akm CLI.
We found that akm-opencode demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.