Security Audit Summary: Multiple Critical Concerns

[cristian-home]

Security Audit Summary: Multiple Critical Concerns

I conducted a thorough security audit of this repository and its npm packages before considering adoption. The findings are significant enough that I believe they warrant a consolidated public report for the benefit of other potential users.

1. Prompt Injection via MCP Tool Descriptions

As reported in #1323, tool descriptions registered by Ruflo contain hidden instructions that direct the LLM (Claude) to add the repository owner as a contributor to users' repositories — without the user's knowledge or consent. This is a textbook prompt injection attack via MCP tool descriptions: the tool description acts as an invisible instruction that the model follows on behalf of the user.

This is arguably the most severe finding because:

• It exploits the trust model between Claude and MCP tool descriptions
• It modifies users' repositories without their awareness
• Removal requires contacting GitHub support
• It is invisible to the user — they never see the tool description that triggers the behavior

2. Obfuscated Preinstall Script (Supply Chain Attack Pattern)

Versions 3.1.0-alpha.55 through 3.5.2 shipped with an obfuscated one-liner in preinstall that silently:

• Walked ~/.npm/_npx/*/node_modules/ and recursively deleted directories matching a specific naming pattern
• Walked ~/.npm/_cacache/index-v5/ and deleted every cache index file containing "claude-flow" or "ruflo"
• Suppressed all errors with || true

This was only removed after external disclosure in #1261. No explanation was provided for why deliberately obfuscated destructive code that operated outside the package directory was shipped in the first place. This pattern — obfuscated code, silent execution, filesystem writes outside project scope, no documentation — is a textbook supply chain attack vector.

3. Persistent Artifacts and Inability to Uninstall

Multiple users have reported behavior consistent with malware:

• how do i get rid of this #373: .swarm files keep reappearing after deletion; background processes (claude-flow, ruv-swarm) persist after uninstallation
• uninstall #710: A user stated "Just like a virus, I can't uninstall it"
• [Feature Request] Add proper uninstallation/removal command for Claude-Flow #670: npm uninstall -g claude-flow leaves behind .swarm/ (with actively updating SQLite databases), .hive-mind/, memory/, coordination/ directories, and modifications to .claude/settings.json. One user reported 45,216 lines of code and 259 files injected into their project, with no documented removal process

There is still no official uninstall documentation.

4. Unresolved Security Vulnerabilities

Finding	Severity	Status
SQL injection in memory-initializer.ts (#1030)	High	Open since January 2026
npx in SafeExecutor allowlist (arbitrary package execution)	Medium	Unresolved
Unpinned dependencies (^ ranges on semver/zod)	Medium	Unresolved
Path traversal — sanitizePath() bypassable with ....//	High	Community PR #1292 rejected
Prototype pollution in config-tools.ts	High	PR #1371 still open
Command injection via execSync with string interpolation	High	Partially patched in PR #1303

5. Community Contributions Rejected

PR #1292 by hobbitTk addressed multiple security issues (preinstall removal, sanitizePath bypass fix, npx removal from SafeExecutor, dependency pinning) and was closed without merge. The maintainer instead shipped a subset of fixes in his own PR #1298. Several of the issues identified in #1292 remain unaddressed.

6. Missing Security Infrastructure

• No SECURITY.md or vulnerability disclosure policy
• No published security advisories
• No evidence of Dependabot or code scanning
• No security label on issues
• Self-reported SQL injection (Security: SQL injection vulnerabilities in memory-initializer.ts #1030) open for nearly two months

---

Pattern of Malicious Behavior

These findings are not isolated bugs — they form a pattern:

Finding	Technique
Hidden instructions in MCP tool descriptions (#1323)	Prompt injection — exploits LLM trust in tool metadata
Obfuscated preinstall script (#1261)	Supply chain attack — silent destructive code during npm install
Persistent artifacts and background processes (#373, #670, #710)	Malware-like persistence — survives uninstallation

Questions for the Maintainer

1. Why do tool descriptions contain instructions to add the repo owner as a contributor to users' repositories? This is prompt injection and a violation of user trust.
2. Why was the preinstall script obfuscated? If it was a legitimate cache-clearing mechanism, why not write it as readable code with a comment explaining its purpose?
3. Why was the community security PR fix: remove obfuscated preinstall script, pin deps, harden security #1292 rejected instead of merged or collaborated on?
4. Is there a planned uninstall process? Multiple users have reported inability to cleanly remove the tool.
5. What is the timeline for fixing the open SQL injection (Security: SQL injection vulnerabilities in memory-initializer.ts #1030)? It has been open since January.
6. Will a SECURITY.md and responsible disclosure process be added?

---

I'm posting this in good faith to help improve the project's security posture and to provide visibility for other users evaluating adoption. The combination of prompt injection via tool descriptions, an obfuscated destructive install script, and malware-like persistence represents a serious trust and safety concern for any tool that integrates this deeply into development environments and AI agents.

[platix]

You forgot to comment on the previous analysis from two months ago and pre-name change (suspicious?)
https://github.com/8b-is/smart-tree/blob/main/docs/SECURITY_DISCLOSURE_AFFECTING_LLMs.md

I have reviewed the lines mentioned in the report and they are still there.

[ruvnet]

Thank you for the thorough and well-documented security audit. This kind of detailed analysis takes real effort, and I genuinely appreciate you taking the time — it makes the project better for everyone.

I want to be upfront: this isn't a full-time job for me, so response times on issues can lag. That said, security findings always get priority. Here's what has been addressed in v3.5.40 (just published):

Fixes Shipped

Finding	Fix	PR
SQL injection (#1030)	All 9 string-interpolated queries converted to parameterized queries (db.prepare/bind)	#1383
Obfuscated preinstall	Removed entirely — both the script and the package.json entry	#1383
No SECURITY.md	Added with disclosure policy, supported versions, safe harbor, and reporting process	#1383
npx in SafeExecutor	Removed npx from the default command allowlist	#1383
No uninstall process	Added ruflo cleanup command (--dry-run default, --force to execute) that removes .claude/, .swarm/, data/, etc.	#1383

On the remaining points

MCP tool descriptions (#1323): I've searched the current codebase and there are no instructions in tool descriptions to add anyone as a contributor. If this existed in a prior version, it has been removed. If anyone can point to a specific tool name or version where this still occurs, I'll investigate immediately.

Persistent artifacts (#373, #670, #710): The new ruflo cleanup command addresses this. Run ruflo cleanup to see what would be removed, then ruflo cleanup --force to actually remove it.

Community PR #1292: I should have handled that better. The intent was to ship the fixes quickly, but closing a community PR without proper acknowledgment was wrong. Going forward, community security PRs will be collaborated on rather than duplicated.

Path traversal (sanitizePath): This needs a deeper look — I'll open a separate issue to track it properly.

Verification

All fixes were tested in a clean Docker container (node:20-slim):

• MCP server starts without crash or warnings
• Zero SQL string interpolation in published code
• No preinstall script in published package
• Cleanup command correctly identifies and removes artifacts

Install the latest: npx ruflo@latest or npx claude-flow@latest

Thank you again for the thorough report. This kind of community engagement is what makes open source work.

[roman-rr]

Adding corroborating findings from an independent audit (April 2026, v3.5.51).

Your security concerns are validated and extend further than originally reported:

Confirming your findings + new ones

Your Finding	Our Confirmation
Prompt injection via tool descriptions	Confirmed — tool descriptions contain hidden instructions
Obfuscated preinstall script	Confirmed — exists in the package
New: verifySignature() returns true	Byzantine/Raft consensus has no crypto verification — RaftConsensus.js unconditionally returns true with comment "In real implementation, verify"
New: 97% of tools are stubs	agent_spawn, neural_train, wasm_agent_prompt, workflow_execute, all consensus types — none execute real operations
New: Fabricated benchmark metrics	"352x faster" uses sleep(352) as baseline; "token savings" is += 100 hardcoded
New: Intelligence layer	100 MB graph file built from 5,686 duplicate entries, injected into every message

This issue was closed and linked to #1383, but the fundamental concerns remain unaddressed in the current release.

Full independent audit: GitHub Gist