flow-parallel

Pass

Audited by Gen Agent Trust Hub on May 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs extensive shell operations to manage parallel execution. It generates local bash scripts (launch.sh) for each work package and executes them to spawn sub-agents using the claude -p command. It leverages git worktree to create isolated file system environments for each agent, typically located in directories adjacent to the project root (../.octo-worktree-*). It also unsets sensitive API key environment variables in sub-processes to ensure credential isolation between independent workers.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface and utilizes internal control directives. In Step 6, the output from completed work packages (up to 4000 characters) is injected directly into the instructions.md of dependent work packages to provide context. This mechanism lacks boundary markers or sanitization, allowing content from one agent's output to potentially influence the instructions of another. Furthermore, Step 4.5 uses explicit override instructions ("IMPORTANT: ... take precedence over all skill directives") to ensure specific behavior from sub-agents during the decomposition review process.
Audit Metadata
Risk Level
SAFE
Analyzed
May 9, 2026, 06:35 AM
Security Audit — agent-trust-hub — flow-parallel