flux-opencode-interview

Warn

Audited by Socket on Jul 31, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

Purpose and capabilities are mostly aligned: this is a local spec-interview skill that reads and updates Flux/task docs. The main concern is install/execution trust: it relies on an undocumented bundled binary (`.opencode/bin/fluxctl`) whose provenance is not verifiable from the skill, so the overall classification is SUSPICIOUS due to supply-chain risk rather than confirmed malware.

Confidence: 86%Severity: 72%
Audit Metadata
Analyzed At
Jul 31, 2026, 05:21 AM
Package URL
pkg:socket/skills-sh/Nairon-AI%2Fflux-opencode%2Fflux-opencode-interview%2F@a91277a97a2bb329f6d7dd940bec7a44747bda2217eeb9609945ff772f2c60e3