FlowForge Workflow Engine

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 1.1.0

Overview

This skill is a disclosed workflow runner, but it needs Review because it combines broad activation, persistent setup changes, global third-party CLI installation, and agent-delegated execution.

Review before installing. Use this only if you intentionally want a persistent FlowForge workflow runner that may delegate steps to sub-agents. Prefer a pinned or local CLI install, avoid running npm with sudo, do not paste untrusted result text into shell commands, and add explicit approval gates before workflows deploy, post, notify, create PRs, or modify important data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: setup.md:20

Finding

Unpinned Global Installation of a Third-Party CLI Package

Content

View full analysis

Vulnerability Details

File Location: setup.md, line 20
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash

npm install -g @kagura-agent/flowforge

Technical Analysis

The setup guide instructs users to install @kagura-agent/flowforge globally without specifying an exact version or verifying package integrity. Consequently, installation resolves to whichever package version the npm registry currently serves rather than a version reviewed alongside this project.

The CLI implementation and its transitive dependencies are not included in the audited project. Their behavior therefore cannot be verified from this repository. npm packages may also define installation lifecycle scripts that execute with the installing user's privileges. Global installation makes the resulting executable available outside this project and increases the scope of a compromised release.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or a transitive dependency.
2. The attacker publishes a malicious version under the expected package name.
3. A user follows the setup guide and executes the unpinned global installation command.
4. npm retrieves the malicious current version and may execute its lifecycle scripts.
5. The installed CLI can subsequently run attacker-controlled logic whenever an agent or user invokes flowforge.

Impact Assessment

Malicious package or lifecycle code would execute with the operating-system privileges of the user running npm. It could potentially read or modify files accessible to that user, access available environment variables and credentials, make network requests, or alter globally accessible Node.js tooling. This instruction does not itself obtain administrator privileges, although impact would be greater if a user independently ran it with elevated privileges.

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specifically reviewed version, for example @kagura-agent/flowforge@X.Y.Z.
• Document the package's canonical npm registry entry and source repository so users can verify its provenance.
• Publish and verify an expected package integrity hash or signed release artifact.
• Prefer a project-local installation recorded in package.json and a lockfile rather than a global installation.
• Use npm ci with a committed lockfile where practical to ensure reproducible dependency resolution.
• Audit the package's lifecycle scripts and transitive dependencies before recommending installation.
• Consider installing with lifecycle scripts disabled when compatible with the package, and run the CLI in a least-privilege or sandboxed environment.
• Explicitly warn users not to run the installation using sudo or an administrative account.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:61

Finding

Shell Command Injection Through Interpolated Workflow Result Summary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: Shell command injection through unsafe dynamic-text interpolation
Risk Level: Medium

Vulnerable Code

bash

echo "<result summary>" | flowforge advance

The document also offers the following argument-based alternative:

bash

flowforge advance --result "<result summary>"

Technical Analysis

The documented commands place a dynamically generated result summary inside double quotes in a shell command. In common POSIX-compatible shells, double quotes prevent word splitting but do not suppress command substitution. Content such as $(command) or backtick-based command substitution is evaluated by the shell before echo or flowforge receives the argument.

Workflow results may include content originating from repository files, workflow task output, external research, or sub-agent responses. If an agent substitutes such content verbatim into either documented command, malicious shell syntax embedded in that content can become executable rather than remaining inert data. The --result alternative shown in the same section has the same command-substitution hazard when populated through direct textual interpolation.

Attack Path

1. An attacker places a shell-substitution expression in content likely to be included in a workflow or sub-agent result, such as a repository file, task output, or crafted instruction.
2. A workflow executor reads that content and includes it verbatim in the result summary.
3. Following the Skill documentation, the agent inserts the summary between double quotes in the documented shell command.
4. The shell evaluates embedded $(...) or backtick substitutions before invoking echo or flowforge.
5. The injected command executes under the account and environment used by the agent.

Exploitation depends on the executor constructing a shell command through direct textual ...[truncated 616 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct shell commands by inserting workflow or sub-agent output into quoted command text.
• Invoke the CLI through a structured process API that passes each argument directly without a shell.
• Add a FlowForge option that reads the result from standard input or from a designated file without shell interpolation.
• If standard input is supported, write the result bytes directly to the child process rather than generating an echo command.
• If a temporary file is necessary, create it securely with restrictive permissions, pass its fixed path as an argument, and remove it after use.
• Treat repository content, external research, workflow output, and sub-agent responses as untrusted data.
• Explicitly warn agents that shell quoting with double quotes is insufficient for untrusted text and prohibit verbatim interpolation into echo, --result, or similar command examples.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · setup.md (reported line 203)May include surrounding context.

ou'll know exactly which workflow to start.

Troubleshooting

Command not found: flowforge

FlowForge CLI is not installed or not in PATH. Run:

bash

npm install -g @kagura-agent/flowforge

Permission denied

You may need to use sudo (not recommended) or configure npm to install global packages without sudo:

bash

mkdir -p ~/.npm-global
npm config set prefix '~/.npm-global'
echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.bashrc
source ~/.bashrc

Then retry:

bash

npm install -g @kagura-agent/flowforge

Workflow not found after define

Make sure you used the correct YAML path:

bash

flowforge define workflows/your-workflow.yaml

Check registered workflows:

bash

flowforge list

Database location

FlowForge stores state in ~/.flowforge/flowforge.db. To reset everything:

bash

rm -rf ~/.flowforge

Next Steps

• Read SKILL.md to understand how agents use FlowForge
• Read [references/yaml-format.md](references/

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The command 'rm -rf ~/.flowforge' recursively deletes the tool's persisted database and state. In a troubleshooting guide, providing a forceful recursive deletion command without guardrails is dangerous because users or agents may execute it reflexively, causing irreversible loss of local data.

Content

Scanner excerpt · setup.md (reported line 232)May include surrounding context.

FlowForge stores state in ~/.flowforge/flowforge.db. To reset everything:

bash

rm -rf ~/.flowforge

Next Steps

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The command 'rm -rf ~/.flowforge' recursively deletes the tool's persisted database and state. In a troubleshooting guide, providing a forceful recursive deletion command without guardrails is dangerous because users or agents may execute it reflexively, causing irreversible loss of local data.

Content

Scanner excerpt · setup.md (reported line 232)May include surrounding context.

FlowForge stores state in ~/.flowforge/flowforge.db. To reset everything:

bash

rm -rf ~/.flowforge

Next Steps

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises very broad activation cues such as 'step-by-step execution', 'structured workflows', and 'step by step process', which are common phrases across many unrelated tasks. This can cause the skill to be invoked unexpectedly, increasing the chance that an agent enters an unnecessary workflow loop, executes external CLI commands, or delegates work to sub-agents when the user did not specifically intend to use FlowForge.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description "Generic open source contribution workflow" is very broad and does not define specific trigger phrases, scope boundaries, or exclusion conditions. Because this is a manifest file, that vague scope could cause unintended invocation for many unrelated coding-assistance requests involving open source work.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes the skill only as a "Research and learning workflow," which is broad and could overlap with many ordinary requests involving learning, reading, or gathering information. The file does not provide explicit trigger phrases, scope boundaries, or negative examples to clarify when this skill should or should not be invoked.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The setup guide instructs users to install a global npm package and modify shell configuration, which expands system-wide capabilities beyond merely using a workflow skill. While common for CLI setup, these persistent environment changes increase attack surface and normalize elevated installation behavior in a skill document.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Appending to ~/.bashrc creates persistent session changes that affect future shells, not just the current troubleshooting session. In agent skill context, instructing persistent environment modification is risky because it can outlive the immediate task and alter command resolution globally.

Content

Scanner excerpt · setup.md (reported line 201)May include surrounding context.

You may need to use sudo (not recommended) or configure npm to install global packages without sudo:

bash

mkdir -p ~/.npm-global
npm config set prefix '~/.npm-global'
echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.bashrc
source ~/.bashrc

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide presents a destructive reset command that deletes the FlowForge state directory without an explicit warning about data loss or a confirmation step. Users or agents may run it during troubleshooting and unintentionally erase workflow history and persisted state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file provides workflow examples that perform impactful actions such as deploying to a staging environment, sending notifications, and later applying changes, but it does not include an accompanying warning that such workflows may modify systems or should require approval. Because this is documentation for agent-executed workflows, readers could copy these patterns without noticing the need for explicit user disclosure around system-affecting actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.