flow-deep
Fail
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documents and triggers the installation of 'prime-agent' using a dangerous piped command pattern:
curl -fsSL https://app.primeintellect.ai/prime-agent/install.sh | sh. The source URL is not from a verified trusted organization or well-known service on the approved list. - [EXTERNAL_DOWNLOADS]: The orchestration logic recommends the global installation of
@colbymchenry/codegraphvia npm, which is maintained by an unverified individual rather than a trusted organization. - [DATA_EXPOSURE]: The skill performs targeted scanning for sensitive local files to facilitate tool integration, specifically accessing
~/.claude/settings.jsonand~/.prime/agent/auth.jsonto check for theZAI_API_KEY. It also uses a script (scripts/check_context.py) to read user conversation transcripts from~/.claude/projects/to monitor token usage, exposing potentially sensitive user data. - [COMMAND_EXECUTION]: The skill makes extensive use of powerful shell commands and automated scripts to manage its orchestration pipeline, increasing the risk of unintended side effects if inputs are not strictly validated.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process external codebases and task descriptions, which presents an attack surface for instructions embedded in untrusted data.
- Ingestion points: Files within the analyzed codebase, configuration files like
package.json, and session transcripts (~/.claude/projects/). - Boundary markers: The skill uses structured tracking files (
findings.md,STATE.md), but it does not implement explicit delimiters or 'ignore' instructions for all content ingested from external repositories. - Capability inventory: The skill possesses high-privilege capabilities including full shell access (
Bash), file modification (Write,Edit), and the ability to delegate tasks to subagents (Agent). - Sanitization: There is no evidence of sanitization, filtering, or validation of content read from the filesystem before it is processed by the agent.
Recommendations
- AI detected serious security threats
Audit Metadata