security-scan
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes the @claude-flow/cli package from the npm registry using npx. This represents the installation of the official CLI tool provided by the author.
- [COMMAND_EXECUTION]: Executes shell commands to perform security audits, CVE checks, and generate markdown reports.
- [PROMPT_INJECTION]: As a security scanner, the skill processes untrusted codebase content, creating an indirect prompt injection surface.
- Ingestion points: Codebase files accessed through Read and Grep tools.
- Boundary markers: No explicit markers or instructions are provided to isolate scanned data from the agent's control logic.
- Capability inventory: The skill has access to shell command execution (npx) and state persistence via MCP tools (memory_store).
- Sanitization: No specific input validation or sanitization logic is defined in the skill to handle malicious patterns within the scanned codebase.
Audit Metadata