flow-next-prospect
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a strict 'Ralph-block' to prevent autonomous execution in CI/CD or non-interactive environments by checking for
REVIEW_RECEIPT_PATHandFLOW_RALPHvariables. - [SAFE]: Data collection for 'grounding' is limited to local file system operations (git log, CHANGELOG, local epics, and local memory). No network calls are authorized for data collection.
- [SAFE]: The skill uses
!commandsyntax specifically for local setup version checks against bundled plugin files, which is a standard development practice for maintaining tool consistency. - [SAFE]: User credentials or sensitive files (like
.sshor.aws) are not accessed. The skill focuses on project metadata and repository structure. - [SAFE]: Blocking questions are used at critical decision points (Resuming artifacts, floor violations, and final handoff), ensuring the user remains in control of the workflow.
- [SAFE]: File writing is localized to the
.flow/prospectsdirectory with atomic write-then-rename semantics to prevent data corruption.
Audit Metadata