Skills/npm/cli

cli@3.74.0

CAUTION· install only

Publisher claims: "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher claude-flow · publishing for 312 daysInstalls 433KLast detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Auto-update or dynamic fetch configuration; Access to sensitive file paths; Auto-update or dynamic fetch configuration. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset

Static findings

MEDIUM
npx invocation of non-well-known packagebin/cli.js:8 · npx invocation of non-well-known package — may execute untrusted code* This allows: echo '{"jsonrpc":"2.0",...}' | npx @claude-flow/cliFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/src/update/index.js:20 · Auto-update or dynamic fetch configuration — agent may load new code at runtime* Run auto-update check on startupFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/hooks.js:2855 · npx invocation of non-well-known package — may execute untrusted code'Vitest: npx vitest --coverage',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/src/commands/hooks.js:3051 · File type combined with upload action — agent may exfiltrate local data filesoutput.writeln(output.dim('Expected files: coverage/coverage-summary.json, coverage/lcov.info, coverage/coverage-final.json, or .nyc_output/out.json'));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/src/commands/hooks.js:3045 · npx invocation of non-well-known package — may execute untrusted code'Jest: npx jest --coverage',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/src/init/executor.js:1574 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'.env',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/src/index.js:514 · Auto-update or dynamic fetch configuration — agent may load new code at runtimethis.output.writeln(this.output.dim(`Updates available: ${nonAutoUpdates.map(u => `${u.package}@${u.latestVersion}`).join(', ')}`));Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/eject.js:10 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo eject --name my-harness --confirm # actually ejectFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Credential pass-through configurationdist/src/proxy/paths.js:33 · Credential pass-through configuration — agent relays sensitive credentialsexport function proxyTokenPath() {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
npx invocation of non-well-known packagedist/src/commands/hooks.js:2854 · npx invocation of non-well-known package — may execute untrusted code'Jest: npx jest --coverage',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/eject.js:9 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo eject --name my-harness # dry-run planFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/cli.js:146 · npx invocation of non-well-known package — may execute untrusted code// 2. stdin is being piped AND args are "mcp start" (explicit, e.g. npx claude-flow@alpha mcp start)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/src/init/executor.js:1576 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'.env.*.local',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/src/update/index.js:38 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// Auto-update if enabledFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Credential pass-through configurationdist/src/proxy/paths.d.ts:16 · Credential pass-through configuration — agent relays sensitive credentialsexport declare function proxyTokenPath(): string;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
File type combined with upload actiondist/src/commands/hooks.js:2860 · File type combined with upload action — agent may exfiltrate local data filesoutput.writeln(output.dim('Expected files: coverage/coverage-summary.json, coverage/lcov.info, coverage/coverage-final.json, or .nyc_output/out.json'));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagebin/cli.js:90 · npx invocation of non-well-known package — may execute untrusted code' - Or pre-download: npx agentdb',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/src/index.js:506 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeconst result = await runStartupUpdateCheck({ autoUpdate: true });Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/eject.js:95 · npx invocation of non-well-known package — may execute untrusted code{ command: 'npx ruflo eject --name my-harness', description: 'Dry-run; prints what would happen' },Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/hooks.js:2857 · npx invocation of non-well-known package — may execute untrusted code'c8: npx c8 npm test',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/src/init/executor.js:1575 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'.env.local',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/commands/eject.js:97 · npx invocation of non-well-known package — may execute untrusted codecommand: 'npx ruflo eject --name my-harness --confirm',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/hooks.js:2856 · npx invocation of non-well-known package — may execute untrusted code'nyc: npx nyc npm test',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/cli.js:123 · npx invocation of non-well-known package — may execute untrusted code// under common timeout windows (npx default, MCP stdio 30 s). ResolveFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/eject.js:11 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo eject --name my-harness --target /abs/out --confirmFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/init.js:234 · npx invocation of non-well-known package — may execute untrusted code// can run `npx skills add ruvnet/ruflo --all` themselves.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/init.js:236 · npx invocation of non-well-known package — may execute untrusted code// #2777 — earlier versions shelled out to `npx --yes skills add ruvnet/rufloFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/src/mcp-server.d.ts:225 · Process kill command — agent can terminate processes* `kill -0`, and isProcessRunning()'s process-name check on top of it, onlyFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/src/commands/mcp.js:231 · Process kill command — agent can terminate processes// Force kill the existing processFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/src/init/executor.js:2119 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file* Write CLAUDE.md with swarm guidanceFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/commands/mcp.js:11 · MCP server using network transport (SSE/HTTP) — data sent over network…dog } from '../runtime/parent-death-watchdog.js'; import { getServerManager, getMCPServerStatus, resolveMcpHttpAuthToken, ensureDefaultMcpToken, isUnauthenticatedHttpAllowed, isLoopbackHost, filterAdvertisedMcpTools, parseMcpToolSelection,…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Process kill commanddist/src/mcp-server.js:1152 · Process kill command — agent can terminate processes// If we can't inspect the process (macOS, Windows, permissions), fall back to kill checkFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commanddist/src/fs-secure.d.ts:10 · File permission modification command — agent changes file ownership/permissions* chmod fails silently on Windows, where POSIX modes don't apply — that'sFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actiondist/src/commands/hooks.js:3271 · File type combined with upload action — agent may exfiltrate local data filesoutput.writeln(output.dim('Expected files: coverage/coverage-summary.json, coverage/lcov.info, coverage/coverage-final.json, or .nyc_output/out.json'));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/src/init/executor.js:2145 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file// Also write/append global ~/.claude/CLAUDE.md so ruflo tools are used automatically (#1497).Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagedist/src/commands/tui.js:15 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo tui | cat # not a terminal and no --plain: a hint on stderr, exit 2Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/src/mcp-server.js:409 · Process kill command — agent can terminate processes// Force kill if still runningFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/commands/tui.js:11 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo tui # interactive, in a terminal (mouse on: click a page in the bar, scroll with the wheel)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/mcp.js:298 · npx invocation of non-well-known package — may execute untrusted code// pre-fix code from the user's npx cache.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/init/executor.js:405 · npx invocation of non-well-known package — may execute untrusted code// #2448 — Detect and REGENERATE the runaway `npx @claude-flow/cli@latest`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/tui.js:12 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo tui --no-mouse # keyboard only, if SGR mouse reporting fights your terminal's text selectionFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/src/mcp-server.js:1052 · Process kill command — agent can terminate processes* `kill -0`, and isProcessRunning()'s process-name check on top of it, onlyFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/commands/tui.js:13 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo tui --view swarm # start on the Swarm page (keys 1-6 or o c s e m a switch pages)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/src/fs-secure.js:10 · File permission modification command — agent changes file ownership/permissions* chmod fails silently on Windows, where POSIX modes don't apply — that'sFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/commands/init.js:255 · npx invocation of non-well-known package — may execute untrusted code…w\` (umbrella), and \`@claude-flow/cli\` (implementation). Users invoke it as \`npx ruflo <command>\`. ## When to invoke ruflo Suggest ruflo when the task involves any…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/tui.js:14 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo tui --plain | head # one plain frame, exit 0 (scripts, CI)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/init/executor.js:437 · npx invocation of non-well-known package — may execute untrusted code// use the runaway `npx @claude-flow/cli@latest hooks <sub>` form. These fireFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/init/executor.js:413 · npx invocation of non-well-known package — may execute untrusted code// Matches any invocation of `claude-flow hooks statusline` — either via npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/src/mcp-server.d.ts:244 · Process kill command — agent can terminate processes* Plain `kill -0` returns true for any process with the same owner,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/src/mcp-server.js:1115 · Process kill command — agent can terminate processes* Plain `kill -0` returns true for any process with the same owner,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/commands/init.js:162 · npx invocation of non-well-known package — may execute untrusted code// Keep Codex out of the CLI dependency graph so cold `npx ruflo --version`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/src/commands/mcp.js:140 · Process kill command — agent can terminate processes{ command: 'claude-flow mcp start -f', description: 'Force restart (kill existing)' }Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/init/executor.js:414 · npx invocation of non-well-known package — may execute untrusted code// (`npx [--prefer-offline] [@]claude-flow[/cli][@<tag>] hooks statusline …`)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/src/commands/mcp.js:127 · Process kill command — agent can terminate processesdescription: 'Force restart (kill existing server first)',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/init/executor.js:245 · npx invocation of non-well-known package — may execute untrusted code// optionalDependency of the CLI and lands in the npx cache — unreachableFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/log-filters.js:70 · npx invocation of non-well-known package — may execute untrusted code' - Or pre-download: npx agentdb', // line 56Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/init.js:274 · npx invocation of non-well-known package — may execute untrusted codenpx ruflo initFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/src/mcp-server.js:1147 · Process kill command — agent can terminate processesreturn true; // Can't inspect, fall back to kill checkFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈65 tok
1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for @claude-flow/cli@3.74.0 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim claude-flow: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim claude-flowPropose a patch to the maintainer