flux-opencode-propose
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. In Step 0.5, the agent offers to 'import an existing document (Google Doc, Notion page, PRD)'. These documents are externally provided by stakeholders and are ingested into the agent's context. While the skill instructs the agent to focus on 'what and why', malicious instructions embedded within these external documents could attempt to influence the agent's output, bias the 'Engineering Pushback' phase, or manipulate the final PR creation.
- [COMMAND_EXECUTION]: The skill uses a bundled binary named
fluxctllocated in a local directory (.opencode/bin/fluxctl). Instructions command the agent to execute this binary for session management (e.g.,$NBENCHCTL session-phase set propose). While the use of bundled tools is common in specific environments, executing local binaries can be a risk if the binary was not provided by a trusted source or if it is modified by a malicious stakeholder during the proposal process.
Audit Metadata