skills/ruvnet/ruflo/vector-search/Gen Agent Trust Hub

vector-search

Pass

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the download and execution of the @claude-flow/cli package from the NPM registry via npx. This is used as a CLI alternative for interacting with the embedding services.
  • [COMMAND_EXECUTION]: Provides instructions for using shell commands via Bash to manage vector indexes, including initializing engines and performing similarity searches.
  • [PROMPT_INJECTION]: Identifies a potential surface for indirect prompt injection.
  • Ingestion points: Untrusted data enters the context through the <query> argument and the corpus of documents retrieved during mcp__claude-flow__embeddings_search or mcp__claude-flow__memory_search_unified operations.
  • Boundary markers: Absent. The skill instructions do not provide delimiters or specific guidance for the agent to differentiate between user instructions and data retrieved from the vector database.
  • Capability inventory: The agent has access to Bash for shell execution and a wide array of tools for vector database manipulation (embeddings_*, ruvllm_hnsw_*).
  • Sanitization: No validation or sanitization of ingested search strings or retrieved document content is specified.
Audit Metadata
Risk Level
SAFE
Analyzed
May 19, 2026, 10:47 PM
Security Audit — agent-trust-hub — vector-search