flow-nexus-neural
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires users to install the
flow-nexuspackage from the npm registry using thenpxutility. This introduces a dependency on external code that is executed during the setup process. Evidence includes the prerequisite commandnpx flow-nexus@latest mcp startand registration commands. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external datasets and inference inputs, creating a surface for indirect prompt injection if the ingested data contains malicious instructions targeting the AI agent. * Ingestion points: Data enters the system through the
datasetparameter in themcp__flow-nexus__neural_train_distributedtool and theinputparameter in themcp__flow-nexus__neural_predicttool. * Boundary markers: The instructions do not provide specific delimiters or warnings to the agent to treat external dataset content as untrusted. * Capability inventory: The skill has the capability to deploy worker nodes, manage distributed clusters, and execute model training or inference jobs. * Sanitization: There is no mention of sanitization, validation, or integrity checking for the input datasets used for training or prediction.
Audit Metadata