ℹ
Purpose & Capability
The skill claims to integrate deeply with Claude Code and multiple LLM providers and the SKILL.md/guides show exactly those actions (MCP registration, spawning agents, using Anthropic/OpenAI/Google keys). That functionality reasonably requires provider API keys and system config changes, so the capability matches the purpose. However, the registry metadata lists no required env vars or install steps despite the instructions repeatedly requiring ANTHROPIC_API_KEY (and optional OPENAI/GOOGLE keys) and advising system config edits — this metadata mismatch is inconsistent.
!
Instruction Scope
The instructions tell the agent (and the user) to: run network installs (curl | bash via jsdelivr), run npx packages, write API keys into .env and shell startup files, and add entries to ~/.claude/settings.json to register an MCP server. The guides explicitly mark the one‑line curl install as 'AI 可自动执行' (AI may automatically execute). Those steps grant broad system modification rights and involve secrets; they go beyond simple read-only integration and give the agent scope to run arbitrary code on the host.
!
Install Mechanism
Although the registry has no install spec, the docs instruct using 'curl -fsSL https://cdn.jsdelivr.net/gh/ruvnet/ruflo@main/scripts/install.sh | bash' and npx ruflo@latest. Piping an unsigned remote script from a CDN to bash is high risk; npx executes remote npm code (moderate risk). There are no checksums or pinned releases shown in the docs. The download host (jsdelivr -> GitHub user repo) is plausible but unverified in this package metadata.
!
Credentials
The skill clearly requires an Anthropic API key (and optionally other provider keys) to operate, which is proportionate to a multi‑LLM orchestration tool — but the registry metadata claims no required env vars. The guides also instruct writing keys into .env and shell rc files and embedding them into ~/.claude/settings.json for MCP, which increases the attack surface if the install scripts or agent behavior are malicious or buggy.
ℹ
Persistence & Privilege
The skill does not set always:true and is user-invocable, which is normal. However, it instructs adding a persistent MCP entry to ~/.claude/settings.json and restarting Claude Code, which gives the skill a persistent integration point in the user's Claude Code environment. Combined with the instruction that the AI can 'automatically execute' install steps and the detected prompt‑injection pattern, this persistent integration increases potential impact and should be treated carefully.
Scan Findings in Context
[system-prompt-override] unexpected: The SKILL.md/guides include phrasing like 'AI 可自动执行' and other directive language; the pre-scan flagged a system-prompt-override pattern. A skill that attempts to override or influence the evaluator/agent system prompt is unexpected for an installation guide and is a prompt‑injection red flag.
What to consider before installing
This skill does appear to do what it says (Claude Code multi‑agent orchestration) but there are multiple red flags you should verify before installing: 1) Inspect the upstream repository and the install script (https://cdn.jsdelivr.net/gh/ruvnet/ruflo@main/scripts/install.sh) — do not run curl | bash without auditing its contents. 2) Confirm the npm package 'ruflo/claude-flow' and GitHub project identity and recent history; if the repo is untrusted or empty, don't install. 3) Treat API keys with care: create least‑privilege keys, avoid putting them in global shell rc files, and avoid embedding them into arbitrary config files unless you control those files. 4) Prefer to run installation in an isolated environment (VM/container) first and review logs. 5) Because the docs claim the AI can 'automatically execute' commands and a prompt‑injection pattern was detected, avoid granting the agent autonomous execution on your machine until you have audited the code and scripts. If you cannot validate the origin and contents of the install script and package, consider not installing or limiting exposure (use ephemeral credentials, isolated environment).
