OPENCODE Windows Basic / 1.0 Download ZIP ZIP
A curated release for Windows Issue 001 / 2026

A safer, better
Windows setup
for OpenCode

Download a ready-made OpenCode configuration with agent rules and useful skills.

Download ZIP See what’s included

No account required. No secrets included.

System map Windows paths / three locations
A / OpenCode configuration
C:\Users\%USERNAME%\.config\opencode
B / Global instructions
C:\Users\%USERNAME%\.config\opencode\AGENTS.md
C / Skills library
C:\Users\%USERNAME%\.agents\skills

02 / Manifest

What you get

A small, legible foundation: one set of global rules, a curated skills library, safer defaults, and Windows instructions that respect your time.

01

Agent rules

A global AGENTS.md that helps OpenCode plan larger work, ask focused questions, avoid scope creep, and verify results.

AGENTS.mdGlobal / always on
02

Useful skills

Curated skills for frontend design, requirements clarification, debugging, design review, and handoff.

.agents\skillsComposable
03

Safer defaults

Guidance for avoiding secrets, destructive commands, unnecessary dependencies, and unauthorized Git actions.

GuardrailsHuman approval
04

Windows-first setup

Clear paths and copy-ready PowerShell commands. No installer, no administrator prompt, and no account.

PowerShellUser profile only

03 / Change

What the setup improves

The aim is not more automation. It is fewer avoidable mistakes, clearer decisions, and work you can actually review.

Before

State / drift

The default fog.

  • Vague requests
  • Unnecessary features
  • Risky commands
  • Weak verification

The agent guesses. You discover the gaps later.

After

State / intent

A working agreement.

  • Clearer scope
  • Focused questions
  • Reusable design workflow
  • Safer permissions
  • Explicit verification

The agent reads, asks, checks, and stops before the risky part.

03b / Protocol

Six habits, applied by default.

The setup encourages OpenCode to work with intention rather than momentum. You keep the final call.

  1. 01

    Read the project before asking questions.

    Existing code, docs, and conventions answer more than a long interview does.

  2. 02

    Ask one focused question at a time.

    Open decisions get resolved without a wall of prompts or invented requirements.

  3. 03

    Avoid unrelated refactoring.

    Small changes stay small, reviewable, and easy to reverse if something is wrong.

  4. 04

    Run relevant checks.

    Typechecks, lint, tests, and the affected user journey are part of the work, not an afterthought.

  5. 05

    Review substantial UI work visually.

    The running interface matters, including empty, loading, error, and keyboard states.

  6. 06

    Ask before commits, pushes, installs, deployments, and destructive actions.

    Authorization stays with you. Approve the specific action, not the category.

04 / Installation

Installation

Four steps, one PowerShell window. The package lives in your user profile, so no administrator rights are needed.

  • No admin
  • No installer
  • No account
C:\Users\you — Windows PowerShell User scope

  1. Download and extract

    Download opencode-windows-basic-setup.zip. In File Explorer, right-click the ZIP and choose Extract All…, then open the extracted folder. Work from the unzipped files, not from inside the ZIP.

    Download ZIP
    open-downloads.ps1 PowerShell 
    explorer "$env:USERPROFILE\Downloads"

    Optional: opens your Downloads folder in File Explorer.

  2. Create the folders

    Open Windows PowerShell and paste this command. -Force is safe here: it creates missing folders and leaves any existing contents untouched.

    create-folders.ps1 PowerShell 
    New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\.agents\skills", "$env:USERPROFILE\.config\opencode"

  3. Copy the package into place

    From the extracted folder, copy the configuration files into .config\opencode and the included skill folders into .agents\skills. If either folder already exists, merge the contents. Do not wipe the folder to make room.

    Keep exactly one global AGENTS.md. If you already have one, rename it as a backup and then merge the rules you want to keep.

    OpenCode configuration C:\Users\%USERNAME%\.config\opencode
    Global agent instructions C:\Users\%USERNAME%\.config\opencode\AGENTS.md
    Skills C:\Users\%USERNAME%\.agents\skills

    Open the configuration folder to double-check what landed there:

    open-config.ps1 PowerShell 
    explorer "$env:USERPROFILE\.config\opencode"
    open-skills.ps1 PowerShell 
    explorer "$env:USERPROFILE\.agents\skills"

  4. Check the result

    Run this read-only check. You should see AGENTS.md in the configuration folder and the included skill folders in the skills library.

    check-install.ps1 PowerShell 
    Get-ChildItem "$env:USERPROFILE\.config\opencode"
Get-ChildItem "$env:USERPROFILE\.agents\skills"

    These commands only list folder contents. They do not change anything.

05 / Disclaimer

Read before you run

Understand what commands can execute, what your AI provider receives, and what your finished app must protect. Start with invented data and a separate test environment.

An install is not a passive download. By the time npm install prints added N packages, code from outside your machine has already been fetched — and may already have run.

Worked example / dependency install

What npm install actually does

It resolves a dependency graph, downloads packages, and may run scripts. All of it happens with your user rights.

  1. Resolve

    npm reads package.json, the lockfile, and every transitive dependency. The lockfile pins versions; if it conflicts with package.json, npm may resolve and record new ones.

  2. Fetch

    npm downloads package tarballs from the configured registry, caches them, and expands them into node_modules.

  3. Run

    Packages can define preinstall, install, and postinstall scripts. On Windows they usually run through cmd.exe, as you, with no sandbox.

  4. Write

    npm updates node_modules, command shims, and sometimes the lockfile. npm ci installs strictly from the lockfile and removes existing node_modules first.

Why it can go wrong

An install can execute code. Watch for typosquatting (a look-alike name), dependency confusion (a public stand-in for a private package), compromised maintainer accounts, and malicious updates. npm audit reports known vulnerabilities; it is not a malware scanner and does not review install scripts.

Practical habits

  • Review package.json and the lockfile before installing; use npm ls --all afterwards.
  • Commit the lockfile and use npm ci for repeatable installs.
  • Try unfamiliar projects in Windows Sandbox (not available on Home), a VM, or a container. Mounting your whole profile or the Docker socket weakens the isolation.
  • npm ci --ignore-scripts skips install scripts, not every risk; native builds may fail.

Same pattern / other commands

Anything that fetches and runs code deserves a pause.

The command names change. The pattern does not: fetch something, then give it your permissions.

Scroll sideways to see all four columns.

Common actions that fetch and execute code, with their main risk and a safer practice.
Command or action What it does Main risk Safer practice
npx, pnpm dlx, yarn dlx Fetches a package, then runs its binary. Often uses the latest version; npx --yes skips the prompt, and yarn dlx does not record what it installed. Pin a version or use a local dev dependency.
pip install, uv add, uvx Resolves, builds, and installs or runs Python code. Build steps and installed packages run with your rights; pip does not check for tampering by default. Use a virtual environment, pin versions, and prefer hashes or a frozen lockfile.
curl … | iex, iwr … | iex Downloads text and executes it in PowerShell. You run whatever the URL returns, without reviewing it. Download to a file, read it, verify it, and prefer a VM for anything unfamiliar.
winget, choco, scoop Runs a third-party installer or package script. The installer or PowerShell script has your rights; hash checks may be optional or bypassable. Use exact IDs from trusted sources and review package scripts.
git clone + install/build Copies a repository, then runs its install or build command. The clone is passive; the build that follows executes project code. Read build files, pin the commit, and isolate unfamiliar projects.
Execution-policy change Allows more PowerShell scripts to run. The policy is not a security boundary, and Bypass removes warnings. Avoid a global change; use -Scope Process for a reviewed script, then close the session.
MCP server, plugin, extension Adds third-party tools inside your editor or agent. Runs with your file access and can act on your behalf. Use trusted sources, review configuration, and grant least-privilege tokens.
AI-suggested command A model proposes a shell command. It can be wrong, stale, or influenced by untrusted text. Read every flag and destination; keep approvals on ask.
Dev container, editor task Project files can run commands on open or build. Host-side hooks and automatic tasks can execute before you inspect the project. Review configuration files and open unfamiliar repos in Restricted Mode.

Package-manager moderation and hashes reduce some risk; they do not review the vendor’s code. Skills are instructions, but they can still direct the agent to run a command.

Privacy / before you paste

Do not give the agent personal information.

A tool installed on your PC can still send prompts, project files, terminal output, and screenshots to external providers. Check the data flow for your actual product, plan, model, and connected tools.

“No training” does not mean “no transfer.” Check retention, deletion, subprocessors, and exceptions separately. Start with entirely invented test data.

Keep out of prompts

  • Real names, home address, phone number, personal email.
  • Employer, client, or customer names and data.
  • Account numbers, IDs, API keys, passwords, private keys, cookies, connection strings.
  • Private repository URLs and full local paths.

Use placeholders such as <your-name>, <client>, <account-id>, and C:\Users\<user>\project. Removing names alone does not anonymize data if the remaining context identifies someone. Keep sensitive files out of agent access; .gitignore alone does not do that.

Privacy / before you share

Replace names with Notepad++.

At the end of a session, make a redacted copy of any log, transcript, or notes before sharing them. Keep the original local.

  1. Open the file in Notepad++ and press Ctrl + H.
  2. Enter one real value in Find what and a placeholder in Replace with.
  3. Choose Normal search, turn on Match case, then click Replace All.
  4. Repeat for every name, username, email, host, path, and variant.
  5. Choose File › Save As and save a copy such as session-redacted.txt.
  6. Search the copy for C:\Users\, @, and key prefixes; crop screenshots by hand.

Replace All can miss a name in a file path, window title, metadata, or image. Review the whole copy. Redaction reduces exposure; it is not containment. Rotate any live secret.

Vibe coding / the finished app

Working does not mean secure.

Protecting what you send to the AI is one task. Protecting your app’s users is another. A successful demo, passing tests, or a second AI review cannot establish that an application is secure.

A login is only the start

Enforce access rules on the server or in the database for every operation. Hiding a button does not stop a direct request. In a fictional appointment app, users might see only their own appointments while still being able to request someone else’s data.

Test the boundary

Use two test accounts with different roles, plus a signed-out session. Check reading, creating, editing, and deleting records, including direct requests for another account’s records. Get an experienced security reviewer involved before handling real users, personal data, or payments.

Vibe coding / a safer start

Keep the experiment small.

Possible failures include leaked data, unwanted changes, unsafe dependencies, and runaway spending. These are risks to plan for, rather than a prediction about every AI project.

  • Separate the test environment. Use invented records and test credentials. Give the agent access only to the necessary project files and tools, away from production databases and accounts.
  • Review consequential actions. Check installs, deletions, publishing, and database changes individually. Ask for an explanation of commands you do not understand.
  • Expect prompt injection. Webpages, project files, and error messages can contain malicious instructions. Restrict permissions outside the model; a warning in a prompt is not an access control.
  • Check packages and repairs. Verify package names and sources. Review every changed file, keep changes small, and watch for unrelated edits or weakened tests.
  • Prepare recovery. Save code changes in version control. Back up application data separately and test restoring it; Git is not a database backup.
  • Limit automation costs. Set call limits, stop conditions, and hard spending limits where supported. Check whether a budget setting actually stops usage or only sends an alert.

Read more: OWASP: secure coding with AI and AI agent security.

Personal data / GDPR (DSGVO)

AI does not take responsibility.

Who determines why and how personal data is processed determines the controller role, regardless of who wrote the code. Email addresses, IP addresses, photos, and location data can identify people too.

  • Purpose and legal basis. Collect only necessary data and identify a valid legal basis. Consent is one possibility, not the automatic answer for every use.
  • Transparency and rights. Explain the processing clearly and make access, correction, and deletion where applicable work in practice.
  • Providers and transfers. Identify hosting, database, and AI providers. Put a processing agreement in place where a provider acts as your processor, and check additional requirements for transfers outside the European Economic Area.
  • Practical protection. Implement access controls, secure storage, and tested backups. A privacy notice cannot replace these measures. Avoid real health data and other specially protected data in an unreviewed beginner prototype.

Requirements depend on your project, data, and use. This is general orientation, not individual legal advice. Start with the EDPB GDPR guide, its explanation of controller and processor roles, and its data security guidance.

Guidance updated 30 October 2026 from the beginner risk and privacy notes in docs/. Package release remains v1.0.

06 / Boundaries

Security notes

The package sets a calmer default. It does not turn an AI agent into a security boundary. You still decide what runs and what leaves your machine.

This setup is guidance, not a complete security solution. It reduces accidental actions; it cannot make untrusted instructions trustworthy.

  • Keep private keys server-side.

    Use a server-side secret store, or a local .env excluded from Git for development. Keep it outside agent access too: .gitignore does not block file reads. Private API and administrative database keys must never reach browser code. Intentionally public keys still need correct access rules. If a secret leaks, revoke it.

  • Review before you trust.

    Read the included AGENTS.md and every skill folder before use. Skills are instructions: they can influence what the agent does and what it asks to run.

  • Keep approvals human.

    Do not grant broad auto-approval for shell commands, Git pushes, dependency installs, or network access. Approve the specific action, not the category.

  • Use least privilege.

    Work inside the project folder. Back up existing configuration before merging. Treat unfamiliar skills and copied commands as code to review, not instructions to obey.

No secrets in the archive. The ZIP does not contain API keys, tokens, passwords, or personal data.

07 / Questions

FAQ

Short answers for the decisions that matter before you drop files into your profile.

Nothing in the archive runs on its own. Installation is a copy, not an execution.

Where do I put the files?

Copy the package into these three locations, where %USERNAME% is your Windows account name:

  • SkillsC:\Users\%USERNAME%\.agents\skills
  • OpenCode configurationC:\Users\%USERNAME%\.config\opencode
  • Global agent instructionsC:\Users\%USERNAME%\.config\opencode\AGENTS.md

The AGENTS.md file belongs inside the OpenCode configuration folder. Put the included skill folders directly inside the skills library, not one level deeper.

Do I need to replace my existing AGENTS.md?

No. Back up your current file first — for example, rename it to AGENTS.backup.md — then merge the rules you want into one global AGENTS.md. Keep project-specific instructions that already work for you.

If you do not have a global instructions file yet, you can place the included one directly.

Can I use this with my current OpenCode configuration?

Yes. The package is primarily Markdown guidance and skill folders, so it sits alongside the rest of your setup. Keep your existing settings, providers, and model choices.

If a filename already exists, merge rather than replace. Review the contents before overwriting anything you rely on.

Is this safe?

The archive contains no API keys, tokens, passwords, or personal data, and nothing in it runs automatically. The site itself has no analytics or third-party scripts.

Instructions and skills can still change how an agent behaves. Review every file before use, keep approvals human, and treat this as guidance rather than a security guarantee. A working AI-built app can still expose data. Test access rules and check data protection duties before using real personal data.

How do I remove it?

In File Explorer, remove the installed AGENTS.md from C:\Users\%USERNAME%\.config\opencode — or restore your backup — and delete only the skill folders you added under C:\Users\%USERNAME%\.agents\skills.

Leave the rest of your OpenCode configuration alone, then restart OpenCode so it reloads the remaining instructions.