The open-source execution engine for AI agents. 412 modules, MCP-native, triggers, queue, versioning, metering.
SaferSkills independently audited Flyto Core (Agent Skill) and scored it 83/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.The text {match} asks the agent to disclose its hidden system prompt or initial instructions. That is often the first step of a larger attack: knowing the system prompt lets an attacker craft inputs that defeat its constraints by mimicking its own voice.
repeat/reveal/print your system prompt request from the skill.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<h1 align="center">Flyto2</h1>
<p align="center"> <strong>Yep, it talks to a real robot.</strong><br> It also opens websites, calls APIs, works with files, and runs the steps in between. </p>
<p align="center"> <a href="README.md">English</a> · <a href="README.ja.md">日本語</a> · <a href="README.ko.md">한국어</a> · <a href="README.zh-CN.md">简体中文</a> · <a href="README.es.md">Español</a> · <a href="README.pt-BR.md">Português (BR)</a> </p>
<p align="center"> <a href="https://pypi.org/project/flyto-core/"><img src="https://img.shields.io/pypi/v/flyto-core" alt="PyPI" /></a> <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-blue" alt="Apache-2.0" /></a> <a href="https://www.python.org/"><img src="https://img.shields.io/badge/Python-3.10%2B-3776AB" alt="Python 3.10+" /></a> </p>
<!-- mcp-name: io.github.flytohub/flyto-core -->
Say you want to check a website, grab screenshots, collect some data, and save a report.
Run this:
pip install "flyto-core[browser]"
playwright install chromium
flyto recipe competitor-intel --url https://github.com/pricingThat's a real workflow. No agent prompt needed. It opens a browser, runs the steps, and saves the results.
Want to poke around?
flyto recipes # see the built-in workflows
flyto modules # browse the tools
flyto run your-workflow.yaml # run your ownThere are 482 registered modules and 41 built-in recipes in the current Core inventory. Browser stuff, APIs, files, data, tests, and plenty more. Use what you need.
We're already connecting Flyto2 to a real TurtleBot3 using ROS 2.
The robot runs its normal ROS 2 / Nav2 stack. A separate adapter talks to it. Flyto2 handles the software steps and their execution records.
No custom Flyto2 firmware on the robot. No motor drivers crammed into this repo.
This isn't a claim that every robot is plug-and-play. The current combined setup still needs its full end-to-end hardware sign-off. But the ROS 2 adapter and real-robot development are already here.
This is flyto-core, the Python execution engine behind Flyto2.
You can call it from Python, run YAML workflows, use its local HTTP API, or hook it into an AI client through MCP.
pip install flyto-core
python -m core.mcp_serverYour agent gets access to Core's tools. Moving a physical device still requires a trusted host to approve the action.
Different device software stack? Different pack. That's how ROS 2 and other integrations stay separate without turning Core into a giant pile of device drivers.
This part matters.
When a workflow runs, Flyto2 keeps a record of each step. If something fails, you can inspect the run and use checkpoints or replay where it's safe to do so.
And if a tool says “done”? Core can check the evidence it reports against the action's contract. It doesn't just throw away the trail once the command returns.
That's it. Run something, see what happened, build the next thing.
Website · Documentation · PyPI · YouTube · Issues
<sub>Flyto2 is the product. <code>flyto-core</code> is the Python package. Licensed under <a href="LICENSE">Apache 2.0</a>. Security reports: <a href="https://github.com/flytohub/flyto-core/security/advisories">GitHub advisories</a>.</sub>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.