The Agent Skills Directory

[DATA_EXFILTRATION]: The skill aggregates a detailed snapshot of the user's environment, including MCPs, CLI tools, installed skills, and model preferences. This metadata is transmitted to a remote service (defined by NBENCH_PROFILE_SERVICE_URL or ~/.flux/config.json). The aggregation of system-level configurations into a public-anonymous snapshot poses a significant risk of leaking environment details or internal project structures.
[REMOTE_CODE_EXECUTION]: During the import workflow, the skill fetches profile data from an external URL (fetch "$TARGET") and subsequently executes an installation process (install-item). If the fetched data contains malicious installation instructions, it could lead to the execution of arbitrary code on the host system via the local profile-manager.py script.
[COMMAND_EXECUTION]: The skill relies heavily on executing a local Python script (profile-manager.py) to perform system detection, snapshot building, and item installation. These operations involve direct interaction with the host operating system and shell environment.
[CREDENTIALS_UNSAFE]: The skill reads from sensitive configuration paths such as ~/.flux/config.json, ~/.flux/profile-state.json, and ~/.config/opencode/skills. During the export process, there is a risk that secrets, API tokens, or private configurations stored within these directories could be included in the exported snapshot.
[PROMPT_INJECTION]: The skill possesses a significant surface for indirect prompt injection. It ingests untrusted profile data from remote URLs which then dictates the agent's installation plan and user prompts. A malicious profile could be crafted to bypass security checks or mislead the user into authorizing dangerous system modifications.
Ingestion points: Fetches profile JSON from remote URL in workflow.md (Step 4a).
Boundary markers: None identified; the agent is instructed to follow the plan generated from the external file.
Capability inventory: install-item capability allows for automated installation and verification of software components (Step 4b).
Sanitization: No explicit sanitization or validation of the remote profile content is described before the installation plan is generated.

flux-opencode-profile