100Critical
This skill executes unverified remote code via bash pipes and performs unauthorized network operations while lacking necessary tool declarations and documentation, posing a severe security risk.
Skill Info
Nameanthropics/knowledge-work-plugins/nextflow-development
Registrygithub
Version55447a28e6c7
PURLpkg:github/anthropics/knowledge-work-plugins@55447a28e6c7?skill=nextflow-development
Stars21,418
Installs1,300
Source
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
GitHub
1,300 installs
Skills.shDocs
npx skills add https://github.com/anthropics/knowledge-work-pluginsAssessments (3)
AI Agent Traps ↗Remote code download and execution detectedcriticalcommand executionAML.T0050AML.T0053AML.T0072LLM05:2025LLM06:2025
Remote code download and execution detected
100% confidenceline 75
curl -s https://get.nextflow.io \| bash
Unverified shell execution for environment setupmediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
The skill provides a command to pipe a remote script directly into bash, which is a common vector for executing arbitrary, unverified code.
90% confidence
curl -s https://get.nextflow.io | bash
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/geo-sra-acquisition.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[references/geo-sra-acquisition.md](references/geo-sra-acquisition.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/pipelines/atacseq.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[references/pipelines/atacseq.md](references/pipelines/atacseq.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/pipelines/rnaseq.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[references/pipelines/rnaseq.md](references/pipelines/rnaseq.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/pipelines/sarek.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[references/pipelines/sarek.md](references/pipelines/sarek.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/troubleshooting.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[references/troubleshooting.md](references/troubleshooting.md)
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/anthropics/knowledge-work-plugins/nextflow-development)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/anthropics/knowledge-work-plugins/nextflow-development"><img src="https://mondoo.com/ai-agent-security/api/badge/github/anthropics/knowledge-work-plugins/nextflow-development.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/anthropics/knowledge-work-plugins/nextflow-development.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow