flow-next-deps

Pass

Audited by Gen Agent Trust Hub on May 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using a local script (flowctl) and the jq utility. These commands are used to retrieve and process specification IDs, titles, and statuses from the project environment to build dependency graphs.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local project environment (e.g., specification titles and IDs) via the flowctl command. This data is interpolated into the agent's context and displayed in markdown tables, creating a surface where malicious project metadata could influence the agent's behavior.
  • Ingestion points: Specification metadata retrieved via $FLOWCTL specs and $FLOWCTL show commands.
  • Boundary markers: None; external content is directly interpolated into markdown structures.
  • Capability inventory: Limited to read-only status reporting and execution of the local flowctl script provided with the skill.
  • Sanitization: None; external strings are displayed as-is without validation or escaping.
Audit Metadata
Risk Level
SAFE
Analyzed
May 13, 2026, 01:09 AM
Security Audit — agent-trust-hub — flow-next-deps