flux-opencode-remember
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using standard system tools and a local project utility to manage session phases.
- Evidence: Shell execution of
git rev-parseand a binary located at$OPENCODE_DIR/bin/fluxctlwithin the session tracking block inSKILL.md. - [PROMPT_INJECTION]: The skill extracts untrusted user input for persistent storage, creating an indirect prompt injection surface.
- Ingestion points: User requests entering the agent context via trigger phrases like "remember", "always", or "don't forget" as defined in
SKILL.md. - Boundary markers: No explicit delimiters or "ignore embedded instructions" warnings are added to the extracted content before it is passed to the storage layer.
- Capability inventory: The skill delegates storage operations, including file writes to
AGENTS.mdand the.flux/brain/directory, to the referencedflux-opencode-brainskill. - Sanitization: There is no evidence of validation, escaping, or filtering of the user-provided content in
SKILL.mdbefore it is processed for persistence.
Audit Metadata