The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute the @claude-flow/cli package at runtime. Fetching and running code from an external registry using the @latest tag poses a supply chain risk, as the package content could be updated or compromised without a fixed version lock.
[COMMAND_EXECUTION]: The instructions involve executing shell commands using npx and Bash to perform memory transfers and project synchronization.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data through memory imports (memory_import_claude) and project transfers (hooks transfer from-project). This creates an attack surface where instructions embedded within the imported memory files could be processed by the agent.
Ingestion points: mcp__plugin_ruflo-core_ruflo__memory_import_claude tool and hooks transfer from-project command.
Boundary markers: None identified in the instructions to separate data from commands.
Capability inventory: The skill has access to Bash execution and memory storage manipulation tools.
Sanitization: There are no explicit instructions for sanitizing or validating the content of the imported memory files.

rvf-manage