rvf-manage
Pass
Audited by Gen Agent Trust Hub on May 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto download and run the@claude-flow/clipackage from the NPM registry. This is a standard method for executing project-specific utilities.\n- [COMMAND_EXECUTION]: Shell commands are used via theBashtool to perform memory export and migration tasks, such ashooks transfer store. This is consistent with the skill's stated purpose of managing portable memory files.\n- [PROMPT_INJECTION]: An indirect prompt injection surface exists through the memory importation process.\n - Ingestion points: External data is ingested through the
mcp__claude-flow__memory_import_claudetool, which retrieves entries from Claude Code memory stores.\n - Boundary markers: The skill does not explicitly use delimiters or instruction-ignore blocks when processing imported memory content.\n
- Capability inventory: The environment allows for file system operations and shell command execution through the
Bashandhooks_transfertools.\n - Sanitization: The skill lacks explicit sanitization or validation logic for the content of imported memory entries.
Audit Metadata