sub2api-opencode

SUSPICIOUS: the skill is internally consistent as a Sub2API/OpenCode configuration guide, but its core function is to forward API keys and model traffic through a non-official gateway. There is no hidden installer, pre-execution command, or credential-file theft, so this is not malware; the main risk is trust in the third-party proxy and storing credentials in config or env vars.