install-nextflow
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads and executes installation scripts from official project sources. It fetches the Nextflow installer from get.nextflow.io and the SDKMAN installer from get.sdkman.io, piping both directly to the shell for execution.
- [EXTERNAL_DOWNLOADS]: Retrieves software binaries and configuration components from the official Nextflow domain and the SDKMAN service to set up the execution environment.
- [COMMAND_EXECUTION]: Employs shell commands to verify tool versions, manage file placement in the user's local binary directory, and set environment variables like NXF_VER and NXF_EDGE for version control.
- [PROMPT_INJECTION]: The skill instructs the agent to parse output from command execution, specifically tool version strings. While this creates a surface for indirect prompt injection if the local binaries are untrusted, the instructions focus on extracting specific version numbers for compatibility checks.
Audit Metadata