flow-nexus-swarm

Warn

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the flow-nexus package from the NPM registry via npm install -g flow-nexus@latest. This is a third-party dependency from a source not identified as a trusted vendor.\n- [REMOTE_CODE_EXECUTION]: The skill provides instructions to execute remote code from both flow-nexus and claude-flow packages using npx for account registration, login, and managing the MCP server environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill's workflow processing logic is vulnerable to indirect prompt injection.\n
  • Ingestion points: External data enters the agent context via the input_data parameter in the mcp__flow-nexus__workflow_execute tool call within SKILL.md.\n
  • Boundary markers: There are no explicit delimiters or system instructions provided to ensure the agent distinguishes between workflow data and embedded instructions.\n
  • Capability inventory: The platform includes powerful capabilities such as spawning new agents (mcp__flow-nexus__agent_spawn), orchestrating tasks (mcp__flow-nexus__task_orchestrate), and executing multi-step deployment workflows.\n
  • Sanitization: The instructions do not define any sanitization, validation, or filtering mechanisms for the external data ingested into the swarm.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 23, 2026, 02:39 PM