flux-opencode-improve

This skill is mostly coherent with its stated purpose, but it carries medium risk because it can lead the agent to install third-party tools and even other skills, while the actual workflow and verification details are not fully visible. The consent language around session-history access is a positive sign, and there is no clear evidence of credential theft or hidden exfiltration in the provided content.

No direct malicious/backdoor behavior is evident in the provided fragment itself. The main concern is elevated supply-chain execution risk: the workflow can optionally make live outbound API queries for discovery and then automate installation of third-party components using repo-provided scripts, including an npx -y based MCP install. Because the critical trust controls are implemented in external helper scripts (not shown here), it cannot be confirmed that installed artifacts are pinned/verified/allowlisted or that discovery-driven inputs cannot lead to unintended installs. Recommend reviewing discover-community.py and all install/verify/rollback scripts for pinning, signature verification, safe command construction, and input validation.