flux-opencode-work

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides shell command templates that the agent is instructed to execute. This includes running a binary bundled within the project repository at .opencode/bin/fluxctl and performing broad git operations such as git add -A and git commit --amend.- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by ingesting and acting upon untrusted data from external files and project-specific task storage.
  • Ingestion points: The skill reads input from markdown specification files, user-defined idea text, and task state stored in the .flux/ directory (e.g., via fluxctl show and fluxctl cat).
  • Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between data and executable commands within these processed files.
  • Capability inventory: The skill enables shell execution for task management, invokes specialized subagents for memory and quality auditing, and triggers additional automated review skills.
  • Sanitization: The instructions do not specify any sanitization or validation of the data extracted from the external files before it is used in subsequent agent steps or shell command interpolation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 05:20 AM