flux-opencode-improve
Warn
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The workflow executes shell scripts (e.g.,
manage-preferences.sh,install-cli.sh) using variables derived directly from user input ($ARGUMENTS). For example, in Step 1, the--dismiss <name>and--alternative <rec> <alt>options pass user-supplied strings into shell command lines. Without rigorous sanitization, this pattern is susceptible to command injection. - [DATA_EXFILTRATION]: The skill reads local session history from
~/.opencode/sessions/and environment data. While the analysis is described as local, using the optional--discoverflag results in search queries derived from this context being sent to external APIs (Exa and Twitter). - [EXTERNAL_DOWNLOADS]: The skill clones and updates a remote repository (
https://github.com/Nairon-AI/flux-recommendations.git) to fetch recommendation data. It also automates the installation of external tools (MCPs, CLI tools, and plugins) vianpx,brew, and other package managers based on the remote recommendations. - [REMOTE_CODE_EXECUTION]: The installation process for recommended tools involves executing commands specified in the recommendation files (e.g.,
install-cli.sh "<name>" "<install_command>"). This provides a mechanism for executing code defined in a remote, author-controlled repository. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8).
- Ingestion points: Processes untrusted data from local session logs in
~/.opencode/sessions/, which could contain malicious instructions embedded in previous session content. - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are documented for the session parsing or matching logic.
- Capability inventory: The skill possesses the capability to execute shell commands for tool installation and modify local configuration files like
~/.mcp.json. - Sanitization: There is no documentation of sanitization or filtering applied to the content retrieved from session logs before it is used to influence the matching engine.
Audit Metadata