agentflow
Fail
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads code and plugins from an external GitHub repository (github.com/UrRhb/agentflow) belonging to an unverified third party.- [REMOTE_CODE_EXECUTION]: The installation guide instructs users to clone an external repository and manually copy its scripts into the agent's executable skill directory (~/.claude/skills/), allowing for the execution of unverified remote code.- [COMMAND_EXECUTION]: The skill configures persistence on the host system by modifying the crontab to execute a shell script (agentflow-cron.sh) on a recurring 15-minute schedule.- [PROMPT_INJECTION]: The skill processes untrusted data which facilitates indirect prompt injection.
- Ingestion points: Reads task descriptions, state, and comments from external Kanban boards (Asana, GitHub, Linear) and local SPEC.md files.
- Boundary markers: The instructions do not define delimiters or protective prompts to isolate untrusted external data from the agent's core logic.
- Capability inventory: The skill manages high-privilege operations including git cloning, reverting commits, running test suites (npm test), and executing code compilation (tsc).
- Sanitization: No validation or sanitization is performed on the content retrieved from the Kanban boards before it is used to drive agent actions.
Recommendations
- AI detected serious security threats
Audit Metadata