flow-next-deps
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using a local script (
flowctl) and thejqutility. These commands are used to retrieve and process specification IDs, titles, and statuses from the project environment to build dependency graphs. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local project environment (e.g., specification titles and IDs) via the
flowctlcommand. This data is interpolated into the agent's context and displayed in markdown tables, creating a surface where malicious project metadata could influence the agent's behavior. - Ingestion points: Specification metadata retrieved via
$FLOWCTL specsand$FLOWCTL showcommands. - Boundary markers: None; external content is directly interpolated into markdown structures.
- Capability inventory: Limited to read-only status reporting and execution of the local
flowctlscript provided with the skill. - Sanitization: None; external strings are displayed as-is without validation or escaping.
Audit Metadata