flux-opencode-work

SUSPICIOUS: the workflow purpose is coherent, but it hinges on executing an unverifiable bundled binary (fluxctl) and an ambiguously attributed optional rp-cli. No explicit credential theft or exfiltration is shown, so this is not confirmed malware, but install/execution trust is disproportionately weak for a skill that drives broad repo actions.