flow-launcher

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The Python plugin boilerplate in SKILL.md uses subprocess.Popen to launch the Windows Task Manager as a user-invoked action.
  • [COMMAND_EXECUTION]: The C# code provided in gpt.md uses Process.Start to open search result URLs in the system's default browser.
  • [COMMAND_EXECUTION]: The Python script in gemini.md reads the Flow Launcher configuration file from %APPDATA%\FlowLauncher\Settings\Settings.json to inventory plugin states and action keywords.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing user-supplied search queries which are interpolated into search URLs and plugin actions.
  • Ingestion points: User input captured via sys.stdin (Python) and the Query object (C#).
  • Boundary markers: Input is encapsulated within structured JSON-RPC payloads or strongly typed C# objects.
  • Capability inventory: Includes process execution (subprocess.Popen) and filesystem access to configuration files.
  • Sanitization: Search terms are properly URI-encoded in the C# example before being interpolated into GitHub search URLs.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 11:22 PM