flux-opencode-setup

SUSPICIOUS. The stated purpose is plausible and copying CLAUDE.md/AGENTS.md is proportionate, but the skill's core behavior depends on an unseen workflow that installs a CLI with unverifiable provenance from the supplied evidence. No clear credential theft or exfiltration is visible, so this is not confirmed malware, but the hidden install path creates a high supply-chain risk.