FlowForge Workflow Engine

This skill appears to be a coherent workflow-runner, but take these precautions before installing or using it: - Verify the FlowForge CLI package (@kagura-agent/flowforge) before running npm install: inspect the package on the npm registry or its source repository (README, code, publish history). The skill bundle does not include a homepage or source link. - Because the SKILL.md requires a 'flowforge' CLI but the manifest lists no required binary, confirm that the CLI is installed and trustworthy. Prefer installing in a controlled environment (container or VM) first. - Audit any workflow YAMLs you add to workflows/ — workflows contain free-text 'task' fields that the agent will act on; malicious or careless tasks can cause the agent to perform unwanted actions or handle secrets. Never run untrusted workflow files in a privileged environment. - Confirm your agent runtime supports the sessions_spawn API the skill expects (the SKILL.md instructs spawning sub-agents). If the platform doesn't support that, follow a safe fallback policy rather than allowing arbitrary command execution. - Note the local DB path (~/.flowforge/flowforge.db) and reset command (rm -rf ~/.flowforge) are destructive; back up data if needed and avoid blindly following destructive commands. If you want higher assurance, ask the publisher for the FlowForge CLI source repository or package tarball so you can review the code (network calls, telemetry, privileged operations) before installing. If you cannot verify the CLI/package origin, treat the npm install as a higher-risk operation and run it in an isolated environment.