skills/ruvnet/ruflo/vector-cluster/Gen Agent Trust Hub

vector-cluster

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs the ruvector package (version 0.2.25) from the npm registry. This package is a core component of the author's workflow.
  • [COMMAND_EXECUTION]: The skill uses npm and npx to install dependencies and execute clustering commands (hooks graph-cluster and hooks graph-mincut) on local files. These operations are restricted to the functionality of the ruvector tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-specified files to discover clusters, creating a surface where malicious content in those files could influence the agent.
  • Ingestion points: Files passed to ruvector in SKILL.md.
  • Boundary markers: None present.
  • Capability inventory: Bash for package execution, Read for file access, and mcp__plugin_ruflo-core_ruflo__memory_store for saving results.
  • Sanitization: None specified for the file content processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 11:38 AM