flux-opencode-security-scan
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It ingests untrusted data from git diffs and the full content of changed files (Step 2) to perform reasoning and vulnerability detection. If the code being scanned contains malicious instructions (e.g., hidden within comments, strings, or documentation), it could influence the agent's behavior, findings, or report generation.
- Ingestion points: Git diffs and full file contents retrieved in
SKILL.md(Step 2). - Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' prompts when passing code content to the LLM.
- Capability inventory: The skill executes git commands and performs file system write operations to
.flux/security/security-findings.json(Step 6). - Sanitization: There is no evidence of content sanitization or filtering to prevent the agent from following instructions found within the scanned code.
- [EXTERNAL_DOWNLOADS]: The documentation references an external project repository
https://github.com/Factory-AI/factory-plugins. While no automated runtime download or execution is triggered by the skill's instructions, this points to an external third-party source.
Audit Metadata