flux-opencode-deps

SUSPICIOUS: the stated purpose is coherent and the commands mostly perform local dependency analysis, but the skill hinges on an unverifiable project-local `fluxctl` binary with no provenance or integrity guidance. No clear credential theft or exfiltration is shown, so this is not confirmed malware, but the binary trust gap makes the skill high-risk.