FlowZap Diagram Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:37 AM UTC
• Version: 1.3.6

Overview

This is a documentation-only diagram skill with a disclosed FlowZap MCP integration; the main caution is normal third-party npx supply-chain risk.

Install only if you are comfortable using the FlowZap MCP server and sending generated diagram code to flowzap.xyz. Verify flowzap-mcp@1.3.6 against the published integrity values, prefer a pinned or reviewed install source for the skill bundle, and redact secrets, credentials, private URLs, and proprietary process details before creating playground links.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:57

Finding

Third-Party Package Execution Through npx Without Enforced Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:57-83
Vulnerability Type: Third-party dependency and supply-chain risk
Risk Level: Medium

Vulnerable Code

bash

npx skills add flowzap-xyz/flowzap-mcp --skill flowzap-diagrams

bash

# Claude Code
claude mcp add --transport stdio flowzap -- npx -y flowzap-mcp@1.3.6

# Or add to .mcp.json / claude_desktop_config.json / cursor / windsurf config:
{
  "mcpServers": {
    "flowzap": {
      "command": "npx",
      "args": ["-y", "flowzap-mcp@1.3.6"]
    }
  }
}

Technical Analysis

The installation instructions cause npx to retrieve and execute code from external npm sources. The recommended skill-installation command does not pin the skills CLI to a specific version. It also identifies skill content through a remote repository reference, allowing the retrieved content to differ over time.

The MCP package is pinned to flowzap-mcp@1.3.6, and the document provides npm integrity and shasum values elsewhere. These measures reduce exposure but do not eliminate it: the displayed commands do not automatically compare the downloaded package against the documented digest before execution. The reviewed artifact also does not contain the MCP implementation, so its stated filesystem, environment, and network restrictions cannot be independently verified by this audit.

This is a supply-chain weakness rather than evidence that the named packages are currently malicious.

Attack Path

1. An attacker compromises an npm package, package maintainer account, transitive dependency, registry delivery path, or referenced remote repository.
2. The user follows the documented npx installation or MCP configuration instructions.
3. npx downloads the externally controlled package content. The unpinned CLI may resolve to a release that did not exist when the skill was audited.
4. Package installation hooks or runtime code execute with the ...[truncated 1088 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every executable npm package to an exact reviewed version, including the skills CLI.
2. Replace direct npx execution with a controlled installation process using a committed lockfile and npm ci.
3. Enforce integrity verification before execution rather than presenting digests only as optional manual checks.
4. Vendor or mirror reviewed package artifacts in a trusted repository when operationally feasible.
5. Disable or audit npm lifecycle scripts during installation, using --ignore-scripts where compatible.
6. Run the MCP server in a sandbox with minimal filesystem access, a sanitized environment, no unnecessary credentials, and an outbound network allowlist limited to required FlowZap endpoints.
7. Review the exact MCP package and its transitive dependency tree independently, since those implementations are outside this artifact.
8. Require explicit user consent and redact secrets, credentials, tokens, personal data, and proprietary content before sending generated DSL to external validation or playground endpoints.

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

validate them, and return shareable FlowZap playground URLs.

This skill is designed to be paired with the `flowzap-mcp` server. The skill
gives the agent FlowZap-specific diagram knowledge and output rules; the MCP
server provides the actual tools.

## Trust and privacy summary

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

- This skill bundle is documentation only: `SKILL.md` plus reference files. It

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/syntax.md (reported line 26)May include surrounding context.

Advanced example — multi-lane authentication flow](#advanced-example--multi-lane-authentication-flow)

Node definitions

Nodes are declared inside a lane block. Each node has a globally unique ID (n1, n2, …), a shape, and at least a label attribute.

text

n1: circle label:"Start"
n2: rectangle label:"Process Order"
n3: diamond label:"Approved?"
n4: taskbox label:"Review" owner:"Alice" description:"Check docs" system:"CRM"

Rules:

• IDs must be sequential with no gaps: n1, n2, n3 (not n1, n3)
• IDs are globally unique across all lanes
• Attributes use colon syntax: label:"Text" (never label="Text")
• Only 4 shapes: circle, rectangle, diamond, taskbox
• Labels should be max 50 characters (longer triggers a warning)

Edge definitions

Edges connect nodes via handles. Every edge must specify source and target handles with a direction.

text

n1.handle(right) -> n2.handle(left)
n2.handle(right) -> n3.handle(left) [label="Submit"]

*Rules:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The recommended install command uses npx skills add flowzap-xyz/flowzap-mcp --skill flowzap-diagrams without pinning the fetched skill source to an immutable version, tag, or commit. That creates a supply-chain risk: future changes to the remote package or repository could alter the installed skill content and cause users to ingest different instructions than the reviewed version.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

Manual locations:

- Claude Code: `.claude/skills/flowzap-diagrams/SKILL.md`
- Windsurf: `.windsurf/skills/flowzap-diagrams/SKILL.md`
- Cursor: `.cursor/skills/flowzap-diagrams/SKILL.md`

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

Manual locations:

- Claude Code: `.claude/skills/flowzap-diagrams/SKILL.md`
- Windsurf: `.windsurf/skills/flowzap-diagrams/SKILL.md`
- Cursor: `.cursor/skills/flowzap-diagrams/SKILL.md`

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

Manual locations:

- Claude Code: `.claude/skills/flowzap-diagrams/SKILL.md`
- Windsurf: `.windsurf/skills/flowzap-diagrams/SKILL.md`
- Cursor: `.cursor/skills/flowzap-diagrams/SKILL.md`

Static analysis

No suspicious patterns detected.