Flow

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:32 AM UTC
• Version: 0.1.4

Overview

Flow appears legitimate, but it can automatically create and register executable workflow files from broad user input without enough review controls.

Install only in an isolated environment, review generated files in the flows directory and skill_registry.json before running or reusing them, consider disabling automatic registry updates, and pin dependencies to reviewed safe versions before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises orchestration, registry search, security scanning, composition, and CLI execution patterns that imply file I/O, network access, and possible shell-adjacent behavior, yet the manifest declares no permissions or operational constraints. This creates a capability-transparency gap: users or calling systems cannot accurately assess or sandbox what the skill may do, increasing the risk of over-privileged execution and unsafe composition.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The code accepts an arbitrary path and recursively walks directories, opening and reading all Python files it finds. In an agent context, this creates a filesystem inspection capability that can expose sensitive source code or secrets from locations unrelated to the stated workflow-orchestration purpose, especially if an attacker can influence the scan path.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill is described as accepting broad natural-language build requests and compiling them into workflows without clear trigger boundaries, approval gates, or scope restrictions. In an orchestration skill, vague activation criteria can cause unintended invocation for risky requests, leading to unsafe workflow generation or execution paths that exceed user expectations.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The usage examples rely on generic prompts such as building scrapers or monitoring automations, with no activation specificity, safety boundaries, or examples of disallowed behavior. Because this skill orchestrates other components, permissive example phrasing can normalize open-ended requests and increase the chance that downstream capabilities are assembled into workflows that perform sensitive actions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The template-based generator writes arbitrary template-supplied code directly into a Python file without validation, sandboxing, trust checks, or any disclosure. In the context of a skill orchestrator that compiles reusable workflows, templates are effectively code inputs; if an attacker can influence them, this becomes a straightforward path to persistence of malicious code for later execution.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The directory walk silently reads arbitrary .py files without any user-facing notice or consent mechanism. While it is limited to Python files, this still enables unannounced inspection of local codebases and may surface proprietary logic or embedded credentials in scan results.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The UI invites users to build workflows from natural-language input and explicitly says Flow will compose and register them, but it does not provide a clear warning that this action may create files or mutate persistent registry state. In a system that generates and saves reusable workflows, missing informed-consent and side-effect disclosure increases the risk of users unintentionally authoring or storing unsafe automation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The build action sends unrestricted free-form input directly into the orchestration pipeline with progress text indicating parsing, searching, scanning, composing, and registry updates, yet the UI does not warn that the resulting workflow may compose executable code or have filesystem/system effects. In the context of a skill orchestrator that creates reusable workflows, this omission can facilitate unsafe execution or persistence of harmful logic because users are not prompted to review or approve high-impact actions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Flow - Intelligent Skill Orchestrator Dependencies

# Core dependencies
streamlit>=1.28.0
pandas>=2.0.0

# Natural Language Processing

• Confidence: 91% confidence
• Finding: The dependency is specified with a lower-bound range instead of an exact pinned version, which makes builds non-reproducible and can silently pull in newer releases with breaking changes or newly introduced malicious code. In an orchestration skill that may be deployed repeatedly, this weakens supply-chain control and increases the chance of inconsistent or vulnerable environments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Core dependencies
streamlit>=1.28.0
pandas>=2.0.0

# Natural Language Processing
nltk>=3.8.0

• Confidence: 91% confidence
• Finding: Using an unpinned pandas version allows future installs to resolve to different package versions over time, reducing reproducibility and increasing exposure to supply-chain or compatibility issues. While not directly exploitable by itself, it weakens dependency hygiene for a workflow orchestration component that likely processes untrusted user data.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=2.0.0

# Natural Language Processing
nltk>=3.8.0
spacy>=3.6.0

# Security scanning

• Confidence: 95% confidence
• Finding: The nltk dependency is unpinned, which permits uncontrolled resolution to different versions and compounds risk because this package also has known advisories in the reported baseline version. For an NLP-enabled orchestrator, this is more concerning because the package is likely to be actively used on untrusted inputs and possibly downloader functionality.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Natural Language Processing
nltk>=3.8.0
spacy>=3.6.0

# Security scanning
bandit>=1.7.5

• Confidence: 90% confidence
• Finding: An unpinned spacy dependency creates non-deterministic builds and increases supply-chain risk because future installs may introduce unreviewed code or vulnerabilities. In a skill that compiles natural-language requests, parser behavior changes can also affect security assumptions and workflow generation reliability.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

spacy>=3.6.0

# Security scanning
bandit>=1.7.5
safety>=2.3.0

# Code analysis

• Confidence: 88% confidence
• Finding: Leaving bandit unpinned makes the toolchain non-reproducible and can cause inconsistent analysis results across environments. This is primarily a supply-chain and integrity concern rather than an immediate exploitable flaw in the runtime behavior of the skill.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Security scanning
bandit>=1.7.5
safety>=2.3.0

# Code analysis
ast-grep>=0.12.0

• Confidence: 88% confidence
• Finding: The safety package is unpinned, which can lead to inconsistent dependency-resolution and scanner behavior across installs. Although this mainly affects the build and audit pipeline rather than runtime execution, it still weakens supply-chain discipline.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

safety>=2.3.0

# Code analysis
ast-grep>=0.12.0
pylint>=2.17.0

• Confidence: 87% confidence
• Finding: An unpinned ast-grep dependency allows changing versions to be installed over time, reducing reproducibility and potentially introducing vulnerable or malicious releases. Because this is part of code analysis infrastructure, the main risk is to build integrity and analysis consistency.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Code analysis
ast-grep>=0.12.0
pylint>=2.17.0

• Confidence: 87% confidence
• Finding: The unpinned pylint requirement weakens reproducibility and trust in the development pipeline by allowing arbitrary newer versions to be installed. This is a low-severity supply-chain hygiene issue rather than a direct runtime exploit path.

Known Vulnerable Dependency: streamlit==1.28.0 — 5 advisory(ies): CVE-2026-33682 (Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Expo); GHSA-8qw9-gf7w-42x5 (Minor fix to previous patch for CVE-2022-35918); CVE-2024-42474 (Path traveral in Streamlit on windows) +2 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The finding indicates streamlit 1.28.0 is associated with multiple advisories, including high-severity issues such as SSRF and path traversal. In a skill orchestrator that may expose web interfaces and handle workflow definitions, a vulnerable Streamlit version can increase the risk of unauthorized network access, credential exposure, or filesystem compromise depending on deployment context.

Known Vulnerable Dependency: nltk==3.8.0 — 10 advisory(ies): CVE-2026-33236 (NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwr); CVE-2026-0847 (NLTK has a Path Traversal issue); CVE-2025-14009 (NLTK has a Zip Slip Vulnerability) +7 more

Critical

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: The reported nltk 3.8.0 version has multiple serious advisories, including path traversal and zip-slip style issues that may enable arbitrary file overwrite or unsafe extraction behaviors. Because this skill is an NLP-driven orchestrator likely to process external content and possibly use corpus/download features, the context makes exploitation more plausible and the potential impact significantly higher.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: skill_scanner_integration.py:50