The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions and examples heavily rely on 'npx claude-flow'. Using npx causes the agent to download and execute code from the npm registry at runtime. The 'claude-flow' package and its author 'ruvnet' are not verified as trusted entities.
[COMMAND_EXECUTION]: The skill provides numerous shell commands for the agent to execute, such as 'npx claude-flow bottleneck detect' and 'npx claude-flow analysis performance-report --format html', which interact with the system's execution environment.
[DYNAMIC_EXECUTION]: The 'Custom Analysis Scripts' section provides a JavaScript implementation that uses 'child_process.exec' to programmatically assemble and execute shell commands. This pattern is inherently risky as it can lead to command injection if input parameters are not strictly controlled.
[METADATA_POISONING]: There is a clear discrepancy between the author identified in the system context ('microck') and the author identified in the skill's metadata and markdown ('ruvnet' / 'Claude Flow Team'). Furthermore, the metadata claims an unusually high star count (9856) which may be intended to deceptively establish trust.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze performance metrics and task results from external agent swarms, creating a surface for indirect injection.
Ingestion points: Data is ingested via 'claude-flow bottleneck detect' and 'mcp__claude-flow__task_results' which process external swarm operation data.
Boundary markers: The instructions do not specify any delimiters or ignore-instructions for the processed data.
Capability inventory: The skill has access to shell execution ('npx') and file system operations ('fs.writeFileSync').
Sanitization: There is no evidence of sanitization or validation logic to filter out potentially malicious instructions embedded within the performance metrics data.

performance-analysis