flux-opencode-propose

SUSPICIOUS. The workflow is broadly aligned with its stated proposal/PR purpose, but it depends on an unverifiable bundled executable and performs autonomous repository writes. No clear credential theft or malicious exfiltration is shown, yet the binary provenance gap alone makes the skill high security risk.