aqe-ruflo
Warn
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto execute theruflopackage, which triggers the download and execution of external code from the public NPM registry at runtime. - [COMMAND_EXECUTION]: Several shell commands are provided for the agent to execute, specifically
npx ruflo doctorandnpx ruflo discover-plugins, to manage orchestration environment state. - [REMOTE_CODE_EXECUTION]: The use of
npxwith external packages represents a remote code execution vector, as it fetches and runs logic from a third-party source without explicit version pinning or integrity verification.
Audit Metadata