This report does not block or authorize the manifest or ZIP.
The audit confirmed real risks around full environment capture, mutable npx-based external tooling, shell script examples, and predictable /tmp output paths. Most static backtick findings were false positives caused by markdown fences or JavaScript template literals, and no prompt injection text was found.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
4 Files scanned · 1,270 Lines analyzed
14 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
The skill captures the entire process.env object as context for intent analysis. Environment variables commonly contain tokens, keys, and service credentials.
The quick start writes an intent brief to a predictable /tmp path. This is a real data exposure and overwrite risk in shared environments, although it is documented as an example output.
The script reads an arbitrary input file through command substitution and later passes that content to npx claude-flow. This can expose local file contents to external tooling if the script is used as written.
The script captures output from an npx claude-flow agent-spawn command and builds the task from file contents. This is real external command execution with user-controlled analysis data.
This is a runnable shell script template, and the same block invokes npx claude-flow with file-derived input. The risk is external command execution in a workflow users may copy directly.
This shell script template invokes npx claude-flow, reads user responses, and writes local files. It is real executable workflow guidance, not just inert prose.
The documented JavaScript writes the execution brief to disk using fs.writeFile. This is legitimate output behavior, but it can persist sensitive intent details without user path control.
The execution brief is written to a fixed /tmp file path. Predictable temporary paths can leak sensitive task context or collide with other local files.
The workflow exports final results to a fixed /tmp path. The output can contain interpreted user intent and execution details, so predictable temp storage is a real risk.
The integration example writes an intent brief to /tmp. Even as documentation, this directs users toward predictable temporary storage for potentially sensitive planning data.
The SPARC example reads the /tmp intent brief as workflow context. Reusing a predictable temporary path can expose or mix sensitive context between runs.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
The same process.env capture is later stored in memory as part of raw intent input. Persisting full environment data creates a clear secret disclosure risk.
The workflow instructs agents to collect process.env, current working directory, filesystem clues, and recent edits for intent analysis. This can collect secrets and sensitive project metadata beyond what intent clarification requires.
The documented userInput and contextClues objects explicitly include process.env, cwd, filesystem analysis, recent edits, and memory storage. This confirms broad data collection, not just a naming false positive.
The skill declares claude-flow@alpha and repeatedly instructs npx execution. A mutable alpha dependency can change without review and execute third-party code during a clarification workflow.
The dependency and quick start examples explicitly name claude-flow@alpha and npx commands. The supply-chain risk is clear even though many backtick pattern matches were markdown fences.
04
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
FIX-001
High
Full environment capture during intent analysis
Remove process.env from captured context. Collect only needed, nonsecret metadata and redact sensitive values before memory storage.
FIX-002
High
Mutable external dependency execution
Pin claude-flow to a reviewed version and require explicit user confirmation before any npx command runs.
FIX-003
Medium
Predictable temporary output paths
Write results to a user-approved workspace path or create a secure temporary directory with restrictive permissions.
FIX-004
Medium
Shell script examples mix file content with external commands
Quote file paths, validate inputs, and pass structured data through files or stdin instead of inline command strings.
05
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.