flux-opencode-work

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill enforces use of a bundled, repo-controlled CLI, requires always committing hidden control directories (.flux/ and scripts/ralph/), and mandates an automated review/fix loop that can commit changes without human confirmation — patterns that strongly suggest supply-chain/backdoor and potential data-exfiltration misuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md/phases.md, the agent reads outsider-authored “Idea text” from the user input (Phase 1: spec-less start creates an epic/task from the provided text) and then re-reads that generated spec text before each task (Phase 3: $NBENCHCTL cat <epic-id> / $NBENCHCTL cat <task-id>).