{"id":"cmuxikg9x0pezad079ia4kra2","slug":"nextflow","publicId":"b43e3aea-33f2-44d9-8340-c967297bccc6","name":"nextflow","description":"Builds, runs, and debugs Nextflow DSL2 pipelines and nf-core workflows. Use for Nextflow, nf-core, .nf files, nextflow.config, processes/channels/operators, samplesheets, nf-test, modules/subworkflows, container and executor configuration, HPC/SLURM or cloud deployment, and failed or resumed pipeline runs.","version":"1.4","author":"k-dense-ai","license":"Apache-2.0","compatibility":"Requires Bash 3.2+, Java 17-26 and Nextflow. nf-core tools requires Python 3.10+. Containers, scheduler access and network or service credentials depend on the selected workflow.","status":"completed","overallGrade":"F","scannerVersion":11,"fileCount":8,"hasSkillMd":true,"hasScripts":false,"hasReferences":true,"hasEvals":false,"hasAssets":false,"sourceType":"github","sourceUrl":"https://github.com/k-dense-ai/scientific-agent-skills/tree/main/skills/nextflow","createdAt":"2026-10-07T02:54:11.266Z","completedAt":"2026-10-07T02:54:11.263Z","visibility":"public","publishedAt":"2026-09-10T21:05:46.297Z","category":"","frameworks":[],"badgeStatus":"flagged","downloadCount":0,"verdictRationale":{"summary":"Skill has warnings: 1 warning in security or structure checks.","verdict":"warn","scanners":[{"source":"vettd","weight":1,"verdict":"warn"},{"source":"cisco","weight":0.8,"verdict":"fail"}],"consensus":"fail","warnTriggers":["References external URL — review for indirect prompt injection risk"],"policyVersion":"consensus-v1","hardFailTriggers":[]},"verdictPolicyVersion":"consensus-v1","skillId":"cmtw0o8gnbaumad07lwhpz5dd","findings":[{"id":"cmuxikg9x0pf1ad07dpune1sx","source":"cisco","category":"security","label":"Remote fetch followed by execution","detail":"SKILL.md:31 — Content is downloaded from the network and subsequently executed. This is a classic remote code execution attack pattern.","severity":"critical","ruleId":"VTD-0090","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"1a80b4e88d46291a1ffa524e1c11762f","filepath":"SKILL.md"},{"id":"cmuxikg9x0pf2ad071f48ittc","source":"cisco","category":"security","label":"Remote fetch followed by execution","detail":"SKILL.md:43 — Content is downloaded from the network and subsequently executed. This is a classic remote code execution attack pattern.","severity":"critical","ruleId":"VTD-0090","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"1a80b4e88d46291a1ffa524e1c11762f","filepath":"SKILL.md"},{"id":"cmuxikg9x0pf0ad07izyinp8b","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in SKILL.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42638a8b7e9fc5df27449992eaebc724","filepath":"SKILL.md"},{"id":"cmuxikg9x0pf3ad07l17r6yid","source":"cisco","category":"security","label":"Remote fetch followed by execution","detail":"references/testing.md:26 — Content is downloaded from the network and subsequently executed. This is a classic remote code execution attack pattern. (found in documentation — may be instructional)","severity":"medium","ruleId":"VTD-0090","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"ce52b35a99f028231944fcb8e619d961","filepath":"references/testing.md"}],"scannerRuns":[{"source":"cisco","status":"success","verdict":null,"grade":"F","findingCount":3,"criticalCount":2,"highCount":2},{"source":"vettd","status":"success","verdict":null,"grade":"B","findingCount":1,"criticalCount":0,"highCount":0}],"user":{"name":"Kris Mondlane","image":"https://avatars.githubusercontent.com/u/237055?v=4"},"repository":{"owner":"k-dense-ai","name":"scientific-agent-skills"},"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-23T08:56:00.863Z","lastVerifiedAt":"2026-10-23T08:56:00.863Z","lastChangeDetectedAt":"2026-10-08T10:37:35.646Z","scannedHash":"7db04133e61f17f5d839eeba9ef026575a87d2a7","latestUpstreamHash":"7db04133e61f17f5d839eeba9ef026575a87d2a7","nextCheckDueAt":"2026-10-24T07:57:04.826Z"},"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":{"form":"measured","magnitudes":[{"ruleId":"performance/static-context-tokens","label":"Static context tokens","value":3447,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body"}]},"rows":[{"origin":"signal","id":"cmuxikgmn0pgyad07con0qwjl","subjectType":"skill_audit","subjectId":"cmuxikg9x0pezad079ia4kra2","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/static-context-tokens","severity":null,"label":"Static context tokens","detail":null,"valueNum":3447,"valueText":null,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body","derivation":null,"confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T02:54:08.000Z","payload":null},{"origin":"signal","id":"cmuxikhca0pkzad07r028vaf8","subjectType":"skill_audit","subjectId":"cmuxikg9x0pezad079ia4kra2","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/progressive-disclosure","severity":null,"label":"Progressive disclosure","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T02:54:08.000Z","payload":null}]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":{"form":"unjudged"},"rows":[{"origin":"signal","id":"cmuxikgpb0phead07uzgy4y1x","subjectType":"skill_audit","subjectId":"cmuxikg9x0pezad079ia4kra2","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-environment-assumptions","severity":null,"label":"Declared environment assumptions","detail":null,"valueNum":null,"valueText":"Requires Bash 3.2+, Java 17-26 and Nextflow. nf-core tools requires Python 3.10+. Containers, scheduler access and network or service credentials depend on the selected workflow.","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T02:54:08.000Z","payload":null},{"origin":"signal","id":"cmuxikh110pjgad07nbztntvl","subjectType":"skill_audit","subjectId":"cmuxikg9x0pezad079ia4kra2","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-name","severity":null,"label":"Declared skill name","detail":null,"valueNum":null,"valueText":"nextflow","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T02:54:08.000Z","payload":null}]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":27,"publisherSupplied":["name","description","author","version","license"]}