flux-opencode-interview
Warn
Audited by Socket on Jul 31, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
Purpose and capabilities are mostly aligned: this is a local spec-interview skill that reads and updates Flux/task docs. The main concern is install/execution trust: it relies on an undocumented bundled binary (`.opencode/bin/fluxctl`) whose provenance is not verifiable from the skill, so the overall classification is SUSPICIOUS due to supply-chain risk rather than confirmed malware.
Confidence: 86%Severity: 72%
Audit Metadata