flow-next-prospect

Pass

Audited by Gen Agent Trust Hub on May 10, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements a strict 'Ralph-block' to prevent autonomous execution in CI/CD or non-interactive environments by checking for REVIEW_RECEIPT_PATH and FLOW_RALPH variables.
  • [SAFE]: Data collection for 'grounding' is limited to local file system operations (git log, CHANGELOG, local epics, and local memory). No network calls are authorized for data collection.
  • [SAFE]: The skill uses !command syntax specifically for local setup version checks against bundled plugin files, which is a standard development practice for maintaining tool consistency.
  • [SAFE]: User credentials or sensitive files (like .ssh or .aws) are not accessed. The skill focuses on project metadata and repository structure.
  • [SAFE]: Blocking questions are used at critical decision points (Resuming artifacts, floor violations, and final handoff), ensuring the user remains in control of the workflow.
  • [SAFE]: File writing is localized to the .flow/prospects directory with atomic write-then-rename semantics to prevent data corruption.
Audit Metadata
Risk Level
SAFE
Analyzed
May 10, 2026, 06:20 AM