claude-blog-brain
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches prompt templates and framework references from the author's official GitHub repository (AgriciDaniel/flow). This process is protected by a lockfile containing SHA-256 hashes to prevent unauthorized modifications to the downloaded content.
- [COMMAND_EXECUTION]: The system uses Python's subprocess module to coordinate local scripts for vault management, quality auditing, and report rendering. These executions are confined to the project's internal directory and do not expose arbitrary shell access to user-supplied input.
- [INDIRECT_PROMPT_INJECTION]: The skill implements a robust 'Untrusted-Data Contract' for handling external web content and local context files (like BRAND.md). This includes the use of cryptographically strong random nonces and fenced delimiters to ensure the AI agent treats external text as data rather than instructions.
- [DATA_EXFILTRATION]: Comprehensive SSRF (Server-Side Request Forgery) guards are implemented in all modules that perform network operations. The system explicitly blocks access to private, loopback, and reserved IP ranges, and enforces response size caps to prevent data harvesting.
- [PROMPT_INJECTION]: Instructions in the agent definitions that appear to override system rules (e.g., 'ignore prior instructions') are defensive security guidelines intended to prevent the agent from being manipulated by external web content during its research tasks.
Audit Metadata