flux-opencode-reflect
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to manage session states and analyze local files.\n
- It executes a local binary fluxctl (located in .opencode/bin/) to track phases and manage task backlogs.\n
- It uses git rev-parse to identify the project root directory.\n
- It uses find and wc to count files in the brain vault for maintenance triggers.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data to generate permanent logic.\n
- Ingestion points: The skill scans the entire conversation history for mistakes, corrections, and gained knowledge (SKILL.md).\n
- Boundary markers: There are no defined delimiters or instructions to ignore embedded commands within the conversation being analyzed.\n
- Capability inventory: The skill has the ability to write files to .flux/brain/, create new skill definitions in .opencode/skill/, and generate scripts or lint rules. It also autonomously invokes a skill builder agent.\n
- Sanitization: There is no evidence of sanitization or validation of the extracted data before it is persisted or converted into executable content.
Audit Metadata