flow-next-opencode-sync

SUSPICIOUS. The skill’s purpose and capabilities mostly align, and data flow stays local to the repository workflow, but it relies on an unverifiable bundled executable and a delegated subagent without documenting provenance or integrity checks. Risk is driven by execution trust and transitive behavior, not by clear exfiltration or credential theft.