The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local binaries and scripts, specifically $OPENCODE_DIR/bin/fluxctl and $OPENCODE_DIR/skill/flux-opencode-meditate/scripts/snapshot.sh. These operations are used to manage session phases and create brain snapshots within the vendor's environment.
[DATA_EXFILTRATION]: The skill accesses sensitive user data by reading conversation history from the ~/.opencode/sessions/ directory. While this access is central to the skill's stated purpose, it constitutes data exposure of private conversation logs.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data (past conversations) and uses it to drive agent behavior and modify local files.
Ingestion points: Past conversation files located in ~/.opencode/sessions/ (as described in SKILL.md).
Boundary markers: Absent. There are no instructions or delimiters provided to subagents to distinguish between legitimate conversation history and potential malicious instructions embedded within that history.
Capability inventory: The skill can execute shell commands via sh and fluxctl, write to the .flux/brain/ directory, and directly modify the SKILL.md files of other skills.
Sanitization: None. The skill parses raw session files into readable text and batches them for analysis without any validation or escaping of the content.

flux-opencode-ruminate