vector-cluster
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs the
ruvectorpackage (version 0.2.25) from the npm registry. This package is a core component of the author's workflow. - [COMMAND_EXECUTION]: The skill uses
npmandnpxto install dependencies and execute clustering commands (hooks graph-clusterandhooks graph-mincut) on local files. These operations are restricted to the functionality of theruvectortool. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-specified files to discover clusters, creating a surface where malicious content in those files could influence the agent.
- Ingestion points: Files passed to
ruvectorinSKILL.md. - Boundary markers: None present.
- Capability inventory:
Bashfor package execution,Readfor file access, andmcp__plugin_ruflo-core_ruflo__memory_storefor saving results. - Sanitization: None specified for the file content processing.
Audit Metadata