flux-opencode-skill-builder

SUSPICIOUS: the skill’s stated purpose mostly matches its behavior, but it relies on an unverified local binary (fluxctl), disables interactive gates, and autonomously installs additional skills, creating a transitive trust risk. No direct credential theft or exfiltration is visible, so this is not confirmed malware, but the executable provenance and self-installing workflow make it high security risk.