How do I install Ducksay?

Install Ducksay in your harness: Source — https://github.com/zhek/opencode-ducksay/releases/tag/v1.5.0; OpenCode — npx skills@1.7.4 add zhek/opencode-ducksay; Any agent — npx skills@1.7.4 add zhek/opencode-ducksay. Full step-by-step guidance is on the HOL plugin page.

How do I install Ducksay in Source?

To install Ducksay in Source, start with https://github.com/zhek/opencode-ducksay/releases/tag/v1.5.0. The complete step-by-step install guide for Source is on the HOL plugin page.

How do I install Ducksay in OpenCode?

To install Ducksay in OpenCode, start with npx skills@1.7.4 add zhek/opencode-ducksay. The complete step-by-step install guide for OpenCode is on the HOL plugin page.

How is the Trust Score for Ducksay computed?

Ducksay has a HOL Trust Score of 74 out of 100. The score is a weighted sum of six components from a static scan of the source, capped for high-severity findings and adjusted by two disclosed policies. Memberships and payments are not inputs, and a scan is not a safety guarantee. Full breakdown: https://hol.org/registry/plugins/zhek%2Fopencode-ducksay/trust

Who publishes Ducksay?

Ducksay is published by zhek and listed on HOL.

Ducksay

zhek/opencode-ducksay · v1.5.0 · eca44f1 · OpenCode Plugins

by zhekScan grade: Acceptable

OpenCode TUI plugin that swims an ASCII duck across the session sidebar, types a short joke written by the session's model when a turn ends, and answers the /duck command

Install Source Claim this plugin

Follow0

Trust Score74 Security scan78 Components6

Protect this install with HOL Guard

Guard checks the skills and MCP servers a plugin adds on your machine and asks you before a risky action runs. The scores above are free, and no plan changes them.

Is Ducksay a fit?

From the plugin's manifest and HOL's scan. Anything the plugin does not declare is shown as not declared.

Works with

OpenCode

6 skills

Before you install

Sign-in: Not declared
Declared access: Not declared
License: Not declared

Check before relying on it

Some security checks did not finish: Cisco skill scan. See the evidence
2 medium findings from the scan. See the evidence
The publisher has not verified ownership on HOL.
No license declared in the manifest.

What is Ducksay?

Ducksay is a published opencode plugins plugin for AI coding agents in the OpenCode ecosystem, developed by zhek and distributed through the HOL AI plugin registry. OpenCode TUI plugin that swims an ASCII duck across the session sidebar, types a short joke written by the session's model when a turn ends, and answers the `/duck` command.

Canonical slug: zhek/opencode-ducksay
Version: v1.5.0 · eca44f1 · updated Nov 5, 2026
Open data: entity.json (JSON-LD)

Registry snapshot

Repository: https://github.com/zhek/opencode-ducksay
Canonical profile: https://hol.org/registry/plugins/zhek%2Fopencode-ducksay
Owner verification: Not verified
Scanner: HOL plugin scanner
Security result: Needs review
Digest verified: Yes

6 bundled skillsRead, copy or download each SKILL.mdOpen skills

Trust and security

Trust & reputation

HOL Trust Score

Per-metric points (0–100 each) combined via a weighted average into the overall score.

Installability

100/100

Maintenance

90/100

MCP server setup

100/100

Plugin Security

78/100

Provenance

70/100

Publisher Quality

75/100

Provenance

Plugin root: .
Source repo: https://github.com/zhek/opencode-ducksay
Source commit: eca44f158936…
Publisher verified: No
Owner verified: Not owner verified
Agent Plugins 1.0: Not detected

Continuous scanner CI not detected

This plugin remains listed. Its overall trust score is reduced by 10% because security checks are not maintained in the source repository's CI.

Optional: maintain the scanner in the source repository's CI to receive the full trust score. Listing does not require that change.

README badge not detected

Plugin owners can add the HOL badge to the repository README from Guard Plugins. Distribution, not security evidence. It adds a 2% engagement adjustment to the overall trust score and never changes the security result.

Security posture

See how the Trust Score is computed

Needs review

Security result

Security score

High findings

Provider: codex-plugin-scanner
Grade: C · Acceptable
Version: 3.24.2

codex:hol-plugin-scanner-jwo5KW / cisco-skill-scanner: failedcodex:hol-plugin-scanner-jwo5KW / cisco-mcp-scanner: skipped

[codex:.] Manifest Validation

21/31

9 checks

[codex:.] Security

16/16

9 checks

[codex:.] Operational Security

0/6

5 checks

[codex:.] Best Practices

9/12

5 checks

[codex:.] Marketplace

N/A

3 checks · not applicable

[codex:.] Skill Security

5/5

4 checks

[codex:.] Code Quality

10/10

2 checks

[opencode:.] OpenCode Plugin

2/2

4 checks

[opencode:.] Security

16/16

6 checks

[opencode:.] Operational Security

0/6

5 checks

[opencode:.] Code Quality

10/10

2 checks

Published advisories

None matched in GitHub security advisories, checked 2026-11-01. This covers published advisories only, not problems nobody has reported.

GitHub security advisories are those the source repository has published.

Findings

mediumoperational-securityDEPENDENCY_LOCKFILE_MISSINGReported 2 times

package.json is present without a corresponding lockfile or pinned dependency snapshot.

Commit a lockfile or use fully pinned requirements for reproducible dependency resolution.

lowoperational-securityDEPENDABOT_MISSINGReported 2 times

Automation or dependency surfaces exist, but .github/dependabot.yml is missing.

Add Dependabot updates for GitHub Actions and dependency manifests.

infomanifest-validationPLUGIN_JSON_RECOMMENDED_AUTHOR

The manifest is missing the documented recommended field "author".

Add "author" to strengthen the plugin manifest metadata.

infomanifest-validationPLUGIN_JSON_RECOMMENDED_LICENSE

The manifest is missing the documented recommended field "license".

Add "license" to strengthen the plugin manifest metadata.

infomanifest-validationPLUGIN_JSON_RECOMMENDED_KEYWORDS

The manifest is missing the documented recommended field "keywords".

Add "keywords" to strengthen the plugin manifest metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_SHORTDESCRIPTION

The interface object is missing a valid "shortDescription" value.

Add a valid "shortDescription" field to the interface metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_LONGDESCRIPTION

The interface object is missing a valid "longDescription" value.

Add a valid "longDescription" field to the interface metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_CAPABILITIES

The interface object is missing a valid "capabilities" value.

Add a valid "capabilities" field to the interface metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_WEBSITEURL

The interface field "websiteURL" must use HTTPS or point to a safe in-repo asset.

Update "websiteURL" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_PRIVACYPOLICYURL

The interface field "privacyPolicyURL" must use HTTPS or point to a safe in-repo asset.

Update "privacyPolicyURL" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_TERMSOFSERVICEURL

The interface field "termsOfServiceURL" must use HTTPS or point to a safe in-repo asset.

Update "termsOfServiceURL" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_COMPOSERICON

The interface field "composerIcon" must use HTTPS or point to a safe in-repo asset.

Update "composerIcon" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_LOGO

The interface field "logo" must use HTTPS or point to a safe in-repo asset.

Update "logo" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_SCREENSHOTS

The interface field "screenshots" must use HTTPS or point to a safe in-repo asset.

Update "screenshots" to use HTTPS or an existing relative asset path.

infobest-practicesCODEXIGNORE_MISSING

A .codexignore file helps prevent accidental inclusion of local artifacts and secrets.

Add a .codexignore file with generated assets, local state, and secret paths.

Install guidance

Install in Source

Install v1.5.0 from a native release archive or pinned source.

Install guide

1
Download the release archive
Use the v1.5.0 archive. That tag is a different source revision from later commits on the default branch.
shell
2
Follow the publisher install guide
https://github.com/zhek/opencode-ducksay/blob/v1.5.0/docs/INSTALL.md

Did setup work in Source?

No setup reports for Source yet. Self-reported by signed-in visitors. Copying a command is not counted, and most installs are never reported.

Attested installs: Fewer than 10 attested installs of this plugin in week 2026-W44, so no number is shown. Counted from opt-in HOL Guard install reports, once per machine and runtime, and never mixed with the answers above. How install reports work.

Loading reviews

Plugin manifest

{
  "name": "opencode-ducksay",
  "version": "1.5.0",
  "description": "OpenCode TUI plugin that swims an ASCII duck across the session sidebar, types a short joke written by the session's model when a turn ends, and answers the `/duck` command",
  "repository": "https://github.com/zhek/opencode-ducksay",
  "homepage": "https://github.com/zhek/opencode-ducksay",
  "interface": {
    "displayName": "Ducksay",
    "developerName": "zhek",
    "category": "OpenCode Plugins"
  },
  "skills": "./",
  "holReleaseTag": "v1.5.0",
  "holAssessedCommit": "eca44f15893692cb3607050f0ffdee85d1fc763d",
  "holManifestOrigin": "synthesized",
  "registryIndexVersion": 9
}

Skills

6 SKILL.md files ship with this plugin. Preview, copy, or download each one, then install them with the Skills CLI.

skills-cli

openspec-apply-change
.opencode/skills/openspec-apply-change/SKILL.md
Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks. Also use when the user says "openspec apply", "opsx apply", or "openspec implement".
Raw SKILL.md
openspec-archive-change
.opencode/skills/openspec-archive-change/SKILL.md
Archive a completed OpenSpec change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete. Also use when the user says "openspec archive" or "opsx archive".
Raw SKILL.md
openspec-explore
.opencode/skills/openspec-explore/SKILL.md
Enter OpenSpec explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements in a project that uses OpenSpec. Use when the user wants to think through something before or during an OpenSpec change. Also use when the user says "openspec explore" or "opsx explore".
Raw SKILL.md
openspec-propose
.opencode/skills/openspec-propose/SKILL.md
Propose a new OpenSpec change with all artifacts generated in one step. Use when the user wants to quickly describe what they want to build and get a complete proposal with design, specs, and tasks ready for implementation. Also use when the user says "openspec propose" or "opsx propose".
Raw SKILL.md
openspec-sync-specs
.opencode/skills/openspec-sync-specs/SKILL.md
Sync delta specs from an OpenSpec change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change. Also use when the user says "openspec sync" or "opsx sync".
Raw SKILL.md
openspec-verify-change
.opencode/skills/openspec-verify-change/SKILL.md
Verify implementation matches OpenSpec change artifacts. Use when the user wants to validate that implementation is complete, correct, and coherent before archiving. Also use when the user says "openspec verify" or "opsx verify".
Raw SKILL.md

File inventory

.codex-plugin/plugin.json

plugin-manifest

596 bytes

f500188e8f69c224…

.opencode/plugins/ducksay/index.ts

file

44 bytes

160dbb46259ff45a…

.opencode/plugins/ducksay/tui.ts

file

42 bytes

274396af95d3fa6d…

.opencode/skills/openspec-apply-change/SKILL.md

skill

11,397 bytes

3ebe3a76be0c4078…

.opencode/skills/openspec-archive-change/SKILL.md

skill

16,583 bytes

29f0434179cbc97e…

.opencode/skills/openspec-explore/SKILL.md

skill

22,786 bytes

6474fc37184d469b…

.opencode/skills/openspec-propose/SKILL.md

skill

16,252 bytes

92fc4bfde0595fb2…

.opencode/skills/openspec-sync-specs/SKILL.md

skill

15,769 bytes

3b3cfd2a4a4953ab…

.opencode/skills/openspec-verify-change/SKILL.md

skill

18,358 bytes

814314b87061c08f…

AGENTS.md

file

14,423 bytes

d90a3a1a188e5f6d…

LICENSE

file

1,428 bytes

e446d0f09d0ad875…

package.json

file

1,369 bytes

44b3d0f939a9dd30…

README.md

file

1,578 bytes

189787d30f7d6c53…

README.md

file

1,578 bytes

189787d30f7d6c53…

SECURITY.md

file

562 bytes

c655374cc05616a5…

tsconfig.json

file

533 bytes

a35a7d08319e26dc…

Ducksay — Frequently asked questions

What is Ducksay?: Ducksay is an AI plugin in the HOL registry. OpenCode TUI plugin that swims an ASCII duck across the session sidebar, types a short joke written by the session's model when a turn ends, and answers the /duck command.
How do I install Ducksay?: Install Ducksay in your harness: Source — https://github.com/zhek/opencode-ducksay/releases/tag/v1.5.0; OpenCode — npx [email protected] add zhek/opencode-ducksay; Any agent — npx [email protected] add zhek/opencode-ducksay. Full step-by-step guidance is on the HOL plugin page.
How do I install Ducksay in Source?: To install Ducksay in Source, start with https://github.com/zhek/opencode-ducksay/releases/tag/v1.5.0. The complete step-by-step install guide for Source is on the HOL plugin page.
How do I install Ducksay in OpenCode?: To install Ducksay in OpenCode, start with npx [email protected] add zhek/opencode-ducksay. The complete step-by-step install guide for OpenCode is on the HOL plugin page.
How is the Trust Score for Ducksay computed?: Ducksay has a HOL Trust Score of 74 out of 100. The score is a weighted sum of six components from a static scan of the source, capped for high-severity findings and adjusted by two disclosed policies. Memberships and payments are not inputs, and a scan is not a safety guarantee. Full breakdown: https://hol.org/registry/plugins/zhek%2Fopencode-ducksay/trust
Who publishes Ducksay?: Ducksay is published by zhek and listed on HOL.

Directory acceptance

Listed in 0 of 5 directory lists

Read from the list each directory publishes on GitHub. Being listed means the directory accepted the plugin; it is not a HOL security rating.

Claude Code official marketplaceNot listed
Plugins Anthropic maintains or selected for the marketplace Claude Code ships with.
Claude community directoryNot listed
Plugins submitted through claude.ai that passed Anthropic’s review; the list is a nightly mirror.
Codex curated marketplaceNot listed
Plugins OpenAI lists in the marketplace Codex ships with.
Cursor official pluginsNot in public list
Plugins Cursor publishes itself. Cursor does not publish its list of third-party Marketplace plugins.
Awesome Codex Plugins (HOL)Not listed
The community Codex plugin list HOL maintains on GitHub.

Lists last read Nov 4, 2026. HOL re-reads them every day.

Submitting it? Check it against each directory's rules

Install signal

HOL cannot see every install. These are separate signals from different sources, so they are not added together. Counts under each floor show as <N.

Install commands issued here: <5; HOL Guard install commands issued from this listing, last 28 days.
Opt-in install reports: <10; Machines that reported installing it through HOL Guard in week 2026-W44. Reporting is opt-in, so most installs are not counted.
HOL Guard workspaces: <5; Workspaces that approved it or include it in an approved-plugin feed, as of today.

Reviews and similar plugins

User reviews

No reviews yet. Write the first review

Is Ducksay a fit?

Works with

Before you install

Check before relying on it

What is Ducksay?

Registry snapshot

Trust and security

Trust & reputation

HOL Trust Score

Provenance

Security posture

Published advisories

Findings

Install guidance

Install in Source

Did setup work in Source?

Plugin manifest

Skills

File inventory

Ducksay — Frequently asked questions

Directory acceptance

Install signal

Related plugins

Alternatives in OpenCode Plugins

Reviews and similar plugins

User reviews

Similar plugins