The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a bundled binary located at .opencode/bin/fluxctl. Executing binary files shipped within a skill package is a high-risk practice as the binary's behavior and internal logic are opaque to static analysis and could perform unauthorized actions.
Evidence: The definition of NBENCHCTL="$OPENCODE_DIR/bin/fluxctl" and its subsequent execution throughout SKILL.md and workflow.md.
[REMOTE_CODE_EXECUTION]: The skill uses the shell eval command to execute output produced by the bundled fluxctl binary. This pattern allows the binary to execute arbitrary shell commands on the host system, significantly increasing the risk of malicious activity if the binary is compromised or malicious.
Evidence: eval "$($NBENCHCTL rp setup-review ...)" in both SKILL.md and workflow.md.
[DATA_EXFILTRATION]: The skill writes sensitive review data, including code diffs, prompts, and session receipts, to the world-readable /tmp/ directory. This creates a data exposure risk where other users or processes on the same system could access these files.
Evidence: File writes to /tmp/impl-review-receipt.json, /tmp/review-prompt.md, /tmp/re-review.md, and /tmp/review-instructions.txt.
[PROMPT_INJECTION]: The skill processes untrusted data from the local git repository (git logs and code diffs) and passes it to external review backends without sanitization or boundary markers, creating a surface for indirect prompt injection.
Ingestion points: The skill reads repository state via git log and git diff in SKILL.md and workflow.md.
Boundary markers: None identified; data is directly interpolated into review prompts.
Capability inventory: The skill has significant capabilities including shell execution via eval, execution of the bundled fluxctl binary, and external tool execution (rp-cli).
Sanitization: No evidence of escaping or validating the content of the diffs or logs before processing.

flux-opencode-impl-review