agentic-discovery
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the InFlow CLI via Homebrew from the
inflowpayai/taprepository. - [REMOTE_CODE_EXECUTION]: The documentation includes setup commands that pipe remote scripts to bash for installation (e.g.,
curl -fsSL https://inflowcli.ai/install.sh | bash). These are documented in the metadata under theinstallsection and the## Setupsection of the README. Since these resources are hosted on the vendor's own domain (inflowcli.ai) and align with the skill author's identity (inflowpayai), they are considered legitimate installation instructions for this tool. - [COMMAND_EXECUTION]: The skill uses the
Bash(inflow:*)tool to execute discovery commands. These commands interact with a remote directory and individual services to search for products and offerings. The skill includes explicit warnings to the agent to treat data from these remote services as untrusted content.
Audit Metadata