Skills/npm/agentic-flow

agentic-flow@3.4.4

CAUTION· not started

Publisher claims: "The agentic meta-harness — freeze the model, evolve the harness. An open runtime that routes each query to the cost-optimal model, evolves its own harness (planner/context/reviewer/retry/tool/memory/score policy) and autonomously repairs code, then orches" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher ruvnet · publishing for 420 daysInstalls 453KLast detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
ANTHROPIC_API_KEYE2B_API_KEYGOOGLE_GEMINI_API_KEYOLLAMA_API_KEYOPENROUTER_API_KEYPROXY_API_KEYSREQUESTY_API_KEY or --max-tokensConfiguration, not credentials: AGENT, AGENTDB_PATH, AGENTIC_FLOW_AGENT_BOOSTER, AGENTIC_FLOW_BOOSTER_THRESHOLD, AGENTIC_FLOW_ENABLE_QUIC, ANTHROPIC_BASE_URL, ANTHROPIC_PROXY_BASE_URL, COMPLETION_MODEL, DATASET, DIFF, ENABLE_STREAMING, HEALTH_PORT, KEEP_ALIVE, MODEL, OLLAMA_BASE_URL, OLLAMA_HOST, OLLAMA_MODEL, ONNX_EXECUTION_PROVIDERS, ONNX_MODEL_PATH, ONNX_OPTIMIZED, ONNX_PROXY_PORT, OPENROUTER_BASE_URL, PROVIDER, PROXY_PORT, QUIC_CERT_PATH, QUIC_HOST, QUIC_KEY_PATH, QUIC_MAX_CONNECTIONS, QUIC_MAX_STREAMS, QUIC_PORT, QUIC_SERVER_HOST, QUIC_SERVER_PORT, QUIC_VERIFY_PEER
Where it talks to
no vendor host named in the codeAlso openrouter.ai, ruv.io, e2b.dev — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names openrouter.ai, ruv.io, e2b.dev as well as its own vendor. The guard injects ANTHROPIC_API_KEY, E2B_API_KEY, GOOGLE_GEMINI_API_KEY, OLLAMA_API_KEY, OPENROUTER_API_KEY, PROXY_API_KEYS, REQUESTY_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y agentic-flow

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-09 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive file system command detected; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 17 s · 3 scenarios · 0 deviations
t+CategoryObserved action
17sprocessdependency install exit 1 · (Use `node --trace-warnings ...` to show where the warning was created) npm error Cannot read properties of null (reading 'edgesOut') npm error A complete log of this run can be found in: /tmp/ks-detonate-dxQWbc/task/home/.npm/_logs/2026-11-09T03_50_31_916Z-debug-0.log
17sclaimednot started: dependency install failed (exit 1); the server itself was not observed
17sprocessscript backend runs setup only
17sprocesssecond launch, clock +45 days, CI unset

Static findings

HIGH
Destructive file system command detecteddist/sdk/security.js:67 · Destructive file system command detected/\|\|\s*rm\s+-rf/i, // OR chained destructive rmFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/index.js:148 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconsole.log(` docker run --env-file .env claude-agents --agent <name> --task "Your task"\n`);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/cli-proxy.js:446 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconsole.error('Set it in .env or export GOOGLE_GEMINI_API_KEY=xxxxx');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detecteddist/sdk/security.js:60 · Destructive file system command detected/;\s*rm\s/i, // Command chaining with rmFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/cli-proxy.js:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Must stay the first import: loads cwd/.env (or --env-file <path>), never aFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/utils/load-env.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Side-effect import: load cwd/.env (or --env-file <path>) before any otherFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detecteddist/sdk/security.js:66 · Destructive file system command detected/&&\s*rm\s+-rf/i, // Chained destructive rmFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/cli-proxy.js:479 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconsole.error('Set it in .env or export REQUESTY_API_KEY=sk-xxxxx');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/cli-proxy.js:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// parent directory, and never endpoint overrides from an implicit .env.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/cli-proxy.js:408 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconsole.error('Set it in .env or export OPENROUTER_API_KEY=sk-or-v1-xxxxx');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/utils/cli.js:303 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(read from the environment and ./.env only; *_BASE_URL and *_PROXY_* keysFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/utils/cli.js:304 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesare ignored in ./.env unless the file is passed with --env-file <path>)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/postinstall.js:25 · npx invocation of non-well-known package — may execute untrusted code// npx (parent directory)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/utils/cli.js:194 · npx invocation of non-well-known package — may execute untrusted codenpx agentic-flow reasoningbank demo Run interactive demo comparisonFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/utils/safe-exec.js:85 · npx invocation of non-well-known package — may execute untrusted code* Safe execution of npx commandsFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli-proxy.js:681 · npx invocation of non-well-known package — may execute untrusted codenpx agentic-flow proxy --provider gemini --port 3000Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli/mcp-manager.js:6 · npx invocation of non-well-known package — may execute untrusted code* - npx agentic-flow mcp add weather --npm weather-mcpFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli/mcp-manager.js:8 · npx invocation of non-well-known package — may execute untrusted code* - npx agentic-flow mcp listFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/utils/math.d.ts:9 · File type combined with upload action — agent may exfiltrate local data files* console.log(result); // Output: 4Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/utils/cli.js:180 · npx invocation of non-well-known package — may execute untrusted codenpx agentic-flow [COMMAND] [OPTIONS]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli/mcp-manager.js:9 · npx invocation of non-well-known package — may execute untrusted code* - npx agentic-flow mcp remove weatherFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli-proxy.js:664 · npx invocation of non-well-known package — may execute untrusted codenpx agentic-flow proxy [OPTIONS]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/utils/cli.js:197 · npx invocation of non-well-known package — may execute untrusted codenpx agentic-flow reasoningbank benchmark Run performance benchmarksFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli-proxy.js:783 · npx invocation of non-well-known package — may execute untrusted codenpx agentic-flow quic [OPTIONS]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/utils/cli.js:196 · npx invocation of non-well-known package — may execute untrusted codenpx agentic-flow reasoningbank init Initialize databaseFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli/mcp-manager.js:81 · npx invocation of non-well-known package — may execute untrusted codeconsole.log('\n💡 Use it with: npx agentic-flow --agent coder --task "your task"');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/index.js:224 · npx invocation of non-well-known package — may execute untrusted code// process entry point (e.g. `node dist/index.js` or `npx agentic-flow`).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsscripts/build.sh:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho " docker run --env-file .env claude-agents:cli --agent goal-planner --task \"Plan feature\""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/cli-proxy.js:4 · npx invocation of non-well-known package — may execute untrusted code* Usage: npx agentic-flow-proxy --agent coder --task "Create code" --openrouterFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/index.js:116 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(result.output);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/utils/math.js:9 · File type combined with upload action — agent may exfiltrate local data files* console.log(result); // Output: 4Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/cli-proxy.js:951 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(result.output || 'Edit applied');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/cli-proxy.js:981 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(result.output);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/cli-proxy.d.ts:4 · npx invocation of non-well-known package — may execute untrusted code* Usage: npx agentic-flow-proxy --agent coder --task "Create code" --openrouterFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/utils/safe-exec.js:96 · npx invocation of non-well-known package — may execute untrusted code// Use npx with --yes to auto-confirmFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli-proxy.js:684 · npx invocation of non-well-known package — may execute untrusted codenpx agentic-flow proxy --provider openrouter --model "openai/gpt-4o-mini"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli/mcp-manager.js:7 · npx invocation of non-well-known package — may execute untrusted code* - npx agentic-flow mcp add local --local /path/to/server.jsFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/postinstall.js:7 · npx invocation of non-well-known package — may execute untrusted code* - This runs after npm install, npm install -g, and npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/utils/cli.js:195 · npx invocation of non-well-known package — may execute untrusted codenpx agentic-flow reasoningbank test Run validation testsFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/postinstall.js:91 · npx invocation of non-well-known package — may execute untrusted codeconsole.log('[agentic-flow] This is OK for npx - runtime patch will handle it');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Fake instruction boundary tagREADME.md:1406 · Fake instruction boundary tag · informational: not an instruction file-e, --error <context> Error context for debuggingFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionscripts/postinstall.js:137 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('[agentic-flow] ⚠️ Postinstall had issues:', error.message);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/postinstall.js:135 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('[agentic-flow] ✅ Postinstall complete');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Fake instruction boundary tagREADME.md:1626 · Fake instruction boundary tag · informational: not an instruction filenpx [email protected] workers dispatch "<prompt>"Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈100 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for agentic-flow@3.4.4 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

4 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim ruvnet: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ruvnetPropose a patch to the maintainer