Flow

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:03 AM UTC
• Version: 0.1.4

Overview

The skill is a coherent workflow builder, but it can automatically persist executable Python generated from unsafely handled user and registry text.

Review carefully before installing. Use an isolated environment, do not expose the Streamlit UI to untrusted users, disable automatic registry updates if possible, inspect every generated FLOW before running it, constrain registry and output paths, and pin dependencies with a lockfile.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: skill_composer.py:151

Finding

Arbitrary Python Source Injection Through Generated Workflow Steps

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skill_composer.py:169

Finding

Registry Metadata Can Inject Python Into Generated Workflows

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skill_scanner_integration.py:140

Finding

Security Scanner Fails Open and Reports Accepted Risk as Passed

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skill_scanner_integration.py:128

Finding

Path-Only Scan Cache Permits Time-of-Check to Time-of-Use Bypass

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:4

Finding

Unpinned and Unnecessarily Broad Third-Party Dependency Installation

Content

View full analysis

=1.28.0 pandas>=2.0.0 # Natural Language Processing nltk>=3.8.0 spacy>=3.6.0 # Security scanning bandit>=1.7.5 safety>=2.3.0 # Code analysis ast-grep>=0.12.0 pylint>=2.17.0 ``` ### Technical Analysis The requirements allow the resolver to select any future version greater than or equal to the specified minimum. The installation is therefore not reproducible and may select releases that were not available or reviewed when this project was audited. No hashes are supplied to authenticate downloaded distributions. Several listed packages are not imported by the core implementation shown in the repository, unnecessarily increasing the dependency graph and attack surface. This finding does not establish that any listed package is currently malicious. The vulnerability is the unsafe dependency-management practice and the resulting exposure to compromised future releases, dependency takeover, or unexpected transitive changes. ### Attack Path 1. A user follows the documented `pip install -r requirements.txt` procedure. 2. The package resolver selects the latest versions satisfying the open-ended constraints, including their transitive dependencies. 3. If a selected release or transitive package has been compromised, its installation or imported runtime code executes in the user’s environment. 4. The package receives the privileges available to the Python installation process and, when imported, the application process. ### Impact Assessment A compromised dependency could ex ...[truncated 495 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims orchestration but also appears to include filesystem traversal, Python file reading, AST analysis, caching, and malicious-pattern scanning. Those extra capabilities expand the attack surface and may expose local source code or sensitive files if scan scope is not constrained, especially in a tool that automatically composes and persists workflows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill claims orchestration but also appears to include filesystem traversal, Python file reading, AST analysis, caching, and malicious-pattern scanning. Those extra capabilities expand the attack surface and may expose local source code or sensitive files if scan scope is not constrained, especially in a tool that automatically composes and persists workflows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims orchestration but also appears to include filesystem traversal, Python file reading, AST analysis, caching, and malicious-pattern scanning. Those extra capabilities expand the attack surface and may expose local source code or sensitive files if scan scope is not constrained, especially in a tool that automatically composes and persists workflows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims orchestration but also appears to include filesystem traversal, Python file reading, AST analysis, caching, and malicious-pattern scanning. Those extra capabilities expand the attack surface and may expose local source code or sensitive files if scan scope is not constrained, especially in a tool that automatically composes and persists workflows.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

- `skill_scanner_integration.py` - Security scanning

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README states that Flow will compose and register new skills, but it does not clearly warn that this process persists generated artifacts to disk for future reuse. In a system that transforms user requests and third-party skills into executable workflows, undisclosed write/persistence behavior can lead to accidental storage of unsafe code, sensitive prompts, or unreviewed automation artifacts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises capabilities that imply file access, code generation, networking, and shell interaction, but it does not declare any explicit tool scope or permissions boundary. For an orchestrator that composes and saves workflows, this omission increases the chance of over-broad execution and makes it difficult for users or a host platform to constrain dangerous actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill states that it tracks skill usage and saves newly composed workflows for reuse, but it does not warn users in the description that their requests and generated artifacts may be persisted. This creates privacy and governance risk because sensitive prompts, workflow logic, or operational metadata could be stored unexpectedly and reused later.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

A broadly worded natural-language invocation can cause the skill to trigger on vague requests and perform powerful orchestration or code-generation steps without sufficiently specific user intent. In a skill that may read files, compose workflows, and save outputs, accidental invocation can lead to unintended actions or over-collection of data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code composes a new skill and, when auto_update_registry is enabled, immediately persists and registers it without any explicit user confirmation or dry-run safeguard. In an orchestrator that turns natural-language requests into executable workflows, this can cause unintended local state changes, persistence of unsafe/generated artifacts, and trust-boundary issues if a user did not intend filesystem or registry modification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The docstring says _load_skill will "Load a skill module," and load_components is documented as loading component skills. In reality, _load_skill just returns {"path": path, "loaded": True} without importing or validating a module, which actively contradicts the documented behavior of real component loading.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generated execute docstring states it will execute the flow, and _execute_step says it will execute a single step. However, the code merely iterates over textual steps and returns canned completed statuses, never invoking loaded components or performing the described workflow actions, which contradicts the intent expressed in the inline documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The README describes scanning and processing user requests and skills but omits privacy and system-impact warnings about handling potentially sensitive content and analyzing untrusted skill files. Users may incorrectly assume that scanning is harmless, when it may involve reading local files, storing metadata, or processing proprietary code and prompts.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or breaking releases through the supply chain.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# Flow - Intelligent Skill Orchestrator Dependencies

# Core dependencies
streamlit>=1.28.0
pandas>=2.0.0

# Natural Language Processing

Unverifiable Dependency: streamlit has 11 known advisory(ies) (CVE-2026-33682 (Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Expo); GHSA-8qw9-gf7w-42x5 (Minor fix to previous patch for CVE-2022-35918); CVE-2023-27494 (Streamlit publishes previously-patched Cross-site Scripting vulnerability) +8 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest does not pin streamlit, and the package has multiple known advisories. Without an exact version, it is impossible to verify whether deployments are using a safe release; in this context, Streamlit is often network-facing, so unresolved advisories can materially increase exposure.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using pandas with only a minimum version means the installed package may vary by environment and time. That creates supply-chain uncertainty and may expose deployments to newly introduced vulnerable releases or incompatible behavior.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

# Core dependencies
streamlit>=1.28.0
pandas>=2.0.0

# Natural Language Processing
nltk>=3.8.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

Pandas has known advisory history, and the missing pin prevents verification of whether an affected version is installed. While the practical exploitability depends on how pandas features are used, the unresolved version ambiguity is still a real supply-chain security concern.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

An unpinned nltk dependency allows dependency resolution to drift to later versions without review. In a skill that performs NLP processing, this increases the risk of pulling a release with security flaws affecting parsing, corpus handling, or network-related functionality.

Content

Scanner excerpt · requirements.txt (reported line 8)May include surrounding context.

text

pandas>=2.0.0

# Natural Language Processing
nltk>=3.8.0
spacy>=3.6.0

# Security scanning

Unverifiable Dependency: nltk has 16 known advisory(ies) (CVE-2021-3828 (NLTK Vulnerable to REDoS); CVE-2026-79674 (NLTK: Corpus Reader Sandbox Bypass); CVE-2026-63311 (NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

NLTK has multiple known advisories, and the current constraint does not establish whether a safe version will be installed. In an orchestrator skill that processes natural language and may interact with external resources or corpora, unverifiable NLP package versions are more concerning than a generic library drift issue.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Specifying spacy as >=3.6.0 permits uncontrolled upgrades during installation. This is a supply-chain hygiene issue because it prevents deterministic builds and may introduce vulnerable versions without explicit approval.

Content

Scanner excerpt · requirements.txt (reported line 9)May include surrounding context.

text

# Natural Language Processing
nltk>=3.8.0
spacy>=3.6.0

# Security scanning
bandit>=1.7.5

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Leaving bandit unpinned makes builds non-reproducible and may introduce compromised or vulnerable tool versions. Although this is a security-scanning tool rather than runtime application code, toolchain integrity still matters because a bad version could miss findings or behave insecurely in CI.

Content

Scanner excerpt · requirements.txt (reported line 12)May include surrounding context.

text

spacy>=3.6.0

# Security scanning
bandit>=1.7.5
safety>=2.3.0

# Code analysis

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Using safety with only a minimum version allows uncontrolled dependency resolution. Because this package is itself used for vulnerability assessment, an unexpected version can affect both trustworthiness and reproducibility of security checks.

Content

Scanner excerpt · requirements.txt (reported line 13)May include surrounding context.

text

# Security scanning
bandit>=1.7.5
safety>=2.3.0

# Code analysis
ast-grep>=0.12.0

Unverifiable Dependency: safety has 2 known advisory(ies) (CVE-2020-5252 (Malicious package may avoid detection in python auditing); CVE-2020-5252 (The command-line "safety" package for Python has a potential security issue. The)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

Safety has known advisories and is not pinned, so the environment may resolve to an affected version without visibility. Because this is a security tool, vulnerable or unreliable versions can undermine confidence in dependency-audit results even if they are not directly exposed at runtime.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The ast-grep dependency is not pinned, so installations may pull different versions over time. This is a supply-chain and reproducibility weakness that can change analysis behavior or introduce vulnerable releases.

Content

Scanner excerpt · requirements.txt (reported line 16)May include surrounding context.

text

safety>=2.3.0

# Code analysis
ast-grep>=0.12.0
pylint>=2.17.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

An unpinned pylint dependency allows future installs to resolve unpredictably. That creates a low-severity supply-chain risk and can affect the reliability of static analysis in CI or local development.

Content

Scanner excerpt · requirements.txt (reported line 17)May include surrounding context.

text

# Code analysis
ast-grep>=0.12.0
pylint>=2.17.0

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: skill_scanner_integration.py:50