flux-opencode-threat-model
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses basic shell commands such as
test,cat,jq, andgrepfor verifying the existence and validity of generated files (.flux/threat-model.mdand.flux/security-config.json). These are standard file system operations for a development tool. - [DATA_EXPOSURE]: The skill identifies sensitive data patterns (PII, credentials, secrets) within the target codebase as part of its threat modeling process. However, the analysis is performed locally, and no instructions were found that exfiltrate this data to external servers.
- [EXTERNAL_DOWNLOADS]: The skill includes a reference link to an external GitHub repository (
Factory-AI/factory-plugins) for attribution purposes. It does not perform any automated downloads or script executions from this source during runtime.
Audit Metadata