skills/frizzlefur/flowkit/flow-deep/Gen Agent Trust Hub

flow-deep

Fail

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill documents and triggers the installation of 'prime-agent' using a dangerous piped command pattern: curl -fsSL https://app.primeintellect.ai/prime-agent/install.sh | sh. The source URL is not from a verified trusted organization or well-known service on the approved list.
  • [EXTERNAL_DOWNLOADS]: The orchestration logic recommends the global installation of @colbymchenry/codegraph via npm, which is maintained by an unverified individual rather than a trusted organization.
  • [DATA_EXPOSURE]: The skill performs targeted scanning for sensitive local files to facilitate tool integration, specifically accessing ~/.claude/settings.json and ~/.prime/agent/auth.json to check for the ZAI_API_KEY. It also uses a script (scripts/check_context.py) to read user conversation transcripts from ~/.claude/projects/ to monitor token usage, exposing potentially sensitive user data.
  • [COMMAND_EXECUTION]: The skill makes extensive use of powerful shell commands and automated scripts to manage its orchestration pipeline, increasing the risk of unintended side effects if inputs are not strictly validated.
  • [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process external codebases and task descriptions, which presents an attack surface for instructions embedded in untrusted data.
  • Ingestion points: Files within the analyzed codebase, configuration files like package.json, and session transcripts (~/.claude/projects/).
  • Boundary markers: The skill uses structured tracking files (findings.md, STATE.md), but it does not implement explicit delimiters or 'ignore' instructions for all content ingested from external repositories.
  • Capability inventory: The skill possesses high-privilege capabilities including full shell access (Bash), file modification (Write, Edit), and the ability to delegate tasks to subagents (Agent).
  • Sanitization: There is no evidence of sanitization, filtering, or validation of content read from the filesystem before it is processed by the agent.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 10, 2026, 10:03 AM
Security Audit — agent-trust-hub — flow-deep