flow-governance-review
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation specifies the use of
pnpm dlxto fetch the@tiangong-lca/clipackage. This is a vendor-owned resource required for the skill's primary governance functions and is treated as a safe source within the vendor's own ecosystem. - [REMOTE_CODE_EXECUTION]: The skill executes remote code by running the
@tiangong-lca/clipackage via thepnpm dlxpackage runner. This execution is the intended method for providing flow governance capabilities and utilizes official software associated with the skill's author. - [INDIRECT_PROMPT_INJECTION]: The skill processes external JSON and JSONL data files, such as flow build plans and approved decisions, which are ingested into the agent's context. This represents a potential attack surface for indirect instructions embedded in data files.
- Ingestion points: Local files containing flow data, build plans, and governance decisions (e.g., ingested via
--input-file,--rows-file, and--decision-filearguments). - Boundary markers: The skill documentation establishes clear boundaries by requiring local files as the system of record and utilizing explicit CLI gates for all remote interactions.
- Capability inventory: The skill wrapper spawns the CLI tool which possesses capabilities for network reads, file writes, and database commits.
- Sanitization: The skill relies on the structured data validation and identity preflight checks implemented within the official vendor CLI tool.
Audit Metadata