OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Warn5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill manages automated workflows by downloading and executing the 'claude-flow' package via npx. This introduces a dependency on an unverified third-party tool and creates a surface for indirect prompt injection through task definitions provided in YAML workflows.
Detected behaviors
No alerts
No issues
1 file scanned · No issues
Score: 93/100 · 2 sections analyzed