Pair Programming
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the 'claude-flow' CLI from the npm registry as a prerequisite for its pair programming features.
- [COMMAND_EXECUTION]: The skill uses various shell commands via the 'claude-flow' utility to manage programming sessions, run test suites, perform code reviews, and handle git operations. It also involves the dynamic generation and execution of code for implementation and refactoring tasks.
- [DATA_EXFILTRATION]: Includes integration with git for version control, allowing for code to be committed and pushed to remote repositories.
- [PROMPT_INJECTION]: The skill ingests source code, file system structures, and git metadata from the local workspace, creating a surface for potential indirect prompt injection.
- Ingestion points: Reads project files, source code, and git logs during pair programming sessions.
- Boundary markers: No specific delimiters or instructions to ignore embedded content are provided in the skill documentation.
- Capability inventory: The skill can modify local files, execute shell commands (via tests and linters), and perform network operations through git.
- Sanitization: There is no mention of sanitization or validation of the ingested code content.
Audit Metadata