agent-coordination
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- Unverifiable Dependencies & Remote Code Execution (LOW): The skill documentation references 'npx claude-flow' for spawning and managing agents. This invokes an external package from the npm registry that is not part of the trusted source list. While typical for developer tools, it represents the execution of third-party code.
- Indirect Prompt Injection (LOW): The skill's primary purpose is to orchestrate multiple specialized agents, which inherently creates a surface for indirect prompt injection. Evidence Chain: 1. Ingestion points: Task definitions and routing codes in SKILL.md. 2. Boundary markers: Absent in the provided documentation. 3. Capability inventory: Ability to spawn and manage lifecycle of multiple agents via shell commands. 4. Sanitization: Not specified; the skill assumes trusted task input for agent coordination.
Audit Metadata