flux-opencode-meditate

Purpose and capabilities mostly align: this is a local knowledge-vault maintenance skill that reads repo files, summarizes them, and edits markdown. The main security issue is execution trust: it depends on an unverified local CLI and an unseen shell script, which makes the install/runtime footprint higher risk than the benign purpose suggests. No clear credential harvesting or off-box data routing is shown, so this is suspicious due to supply-chain trust, not confirmed malware.