The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to execute a binary file located at a path relative to the repository root (.opencode/bin/fluxctl). Executing binaries found within a repository being processed is a high-risk pattern, as the agent may inadvertently run malicious code provided by an untrusted project.
[REMOTE_CODE_EXECUTION]: The skill uses the eval command to execute the output of the local fluxctl binary: eval "$($NBENCHCTL rp setup-review ...)". If the binary is replaced with a malicious version, it can return arbitrary shell commands that the agent will execute with the user's privileges.
[DATA_EXFILTRATION]: The primary purpose of the skill is to aggregate sensitive project data, including full file contents, code structure, and git history, into a markdown file. While the output is directed to the local desktop, the use of a repository-local binary to perform this aggregation creates a significant risk that data could be silently exfiltrated or modified during the process.

flux-opencode-export-context