catalog / Orchestration / Marvin

⌬WorkflowOrchestrationFree

Marvin

Name: Marvin
Availability: InStock
Author: ai-supply

Prefect's Python library for building reliable AI functions, tasks, and workflow orchestration.

@ai-supply

Installationen7.8k

⟳ upstream v3.2.7 · updated 5mo ago

↗ Quell-Repository

← More Orchestration Orchestration leaderboard →How we grade security →Source ↗

! Grade B · 75/100 · ReviewSecurity assessment

✓No compromise signals12capabilities surfaced1known CVE6of 20 OWASP controls clear

Internal host / private infrastructure referenceBroad capability surfacePotentially unbounded loopVulnerable dependencies

scanned 1mo agoosv · gitleaks · opengrep · picklescan + heuristicsfull breakdown in the Security tab ↓

Marvin

Marvin is an 'ambient intelligence' library from Prefect for building reliable AI workflows and applications in Python.

It provides high-level building blocks — AI functions, structured classification/extraction, and task and agent orchestration — that turn LLM calls into typed, composable steps you can drop into normal code.

Apache-2.0 licensed; oriented toward developers who want to orchestrate LLM-powered tasks with the ergonomics of ordinary functions.

! Security: Review · 7575/100 · grade Bscanned 1mo ago

✓ no compromise signals13 risk-surface · 9/20 OWASP controls flagged

Compromise signals — malicious or tampered code (leaked secrets, backdoors, a dropped executable) — reduce the score, and known dependency CVEs carry a bounded penalty (they warrant review but never QUARANTINE — update the dependency to clear). Other dangerous-by-capability traits are risk surface, expected for some capabilities. Every finding is mapped to its OWASP control below.

What this capability can do · high confidence (static)

Tools (4)

get_the_value_of_schleebwrite_a_goose_horror_storyinspect_this_serverhello_world

⚑ filesystem⚑ shell⚑ network⚑ secrets

egress → docs.github.com, pypi.org, ai.pydantic.dev, controlflow.ai, mintlify.com, platform.openai.com, discord.gg, communityinviter.com +31

36 steps⚑ uses secretsactions/checkout@v4google-github-actions/auth@v2google-github-actions/deploy-cloudrun@v2docs.github.comactions/labeler@v5astral-sh/setup-uv@v3astral-sh/setup-uv@v5github.com

Findings mapped to the OWASP Top 10 for LLM Applications (2025) and the OWASP Machine Learning Security Top 10. Expand any flagged control for the exact findings — compromise reduces the score; expected/risk-surface do not, except a known CVE, which carries a small bounded penalty (high/critical → Review).

OWASP Top 10 for LLM Applications

⚠LLM03Supply Chaincritical

Vulnerable/compromised dependencies, models or archives in the artifact.

•Vulnerable dependencies — 191 known vulnerabilities in: aiohttp@3.13.1, authlib@1.6.5, chromadb@1.2.1, cryptography@45.0.7, diskcache@5.6.3, fastmcp@3.0.0b2.dev20+b77484e1, filelock@3.20.0, gitpython@3.1.45 (CWE-1395)known CVE · -25 pts

⚠LLM01Prompt Injectionhigh

Adversarial instructions embedded in an artifact that hijack a downstream LLM.

•Prompt-injection phrasing — instruction-subversion language detected · PrefectHQ-marvin-7c3e20a/src/marvin/templates/system.jinja (CWE-77)expected

⚠LLM05Improper Output Handlinghigh

Code that pipes model/user output into shell, eval, SQL or paths unsafely.

•Suspicious code patterns — OS command execution · PrefectHQ-marvin-7c3e20a/README.md (CWE-78)expected

•Suspicious code patterns — dynamic code execution · PrefectHQ-marvin-7c3e20a/examples/english_to_schema.py (CWE-95)expected

•Suspicious code patterns — destructive rm -rf /; pipe-to-shell install · PrefectHQ-marvin-7c3e20a/examples/slackbot/Dockerfile.slackbot (CWE-78)expected

•Suspicious code patterns — pipe-to-shell install · PrefectHQ-marvin-7c3e20a/examples/you_have_been_goosed/README.md (CWE-494)expected

⚠LLM07System Prompt Leakagemedium

Secrets, internal hosts or proprietary logic exposed in shipped prompts.

•Internal host / private infrastructure reference — shipped content references a private IP range or internal-only host · PrefectHQ-marvin-7c3e20a/README.md (CWE-200)risk surface

⚠LLM10Unbounded Consumptionmedium

Unbounded loops/recursion causing DoS or runaway cost.

Enforced at runtime by the gateway (rate limits + spend caps + size caps); static check flags unbounded loops.

•Potentially unbounded loop — an infinite loop (while True / while(1) / for(;;)) may cause runaway consumption · PrefectHQ-marvin-7c3e20a/docs/guides/building-a-chatbot.mdx (CWE-835)risk surface

⚠LLM06Excessive Agencylow

Over-broad tool/permission surface or unrestricted egress.

•External endpoints declared — 1 distinct host(s) · PrefectHQ-marvin-7c3e20a/.github/workflows/image-build-and-push-community.yamlexpected

•Broad capability surface — 3 high-impact capability categories referenced — verify least-privilege · PrefectHQ-marvin-7c3e20a/README.md (CWE-272)risk surface

•External endpoints declared — 4 distinct host(s) · PrefectHQ-marvin-7c3e20a/README.mdexpected

•External endpoints declared — 3 distinct host(s) · PrefectHQ-marvin-7c3e20a/docs/docs.jsonexpected

•External endpoints declared — 2 distinct host(s) · PrefectHQ-marvin-7c3e20a/docs/guides/database-migrations.mdxexpected

§LLM09MisinformationGovernance

Artifacts designed to produce false/deceptive output.

Detectable only by runtime behavioral evaluation; addressed via responsible-use attestation.

✓LLM02Sensitive Information DisclosurePassed

✓LLM04Data and Model PoisoningPassed

Backdoors/poisoning in training data or serialized models.

Behavioral poisoning needs model execution; static check covers unsafe serialization + dataset skew only.

✓LLM08Vector and Embedding WeaknessesPassed

PII or plaintext source leakage in embedding/vector exports.

Embedding inversion/poisoning is largely runtime; static check covers PII in vector exports.

OWASP Machine Learning Security Top 10

⚠ML06AI Supply Chaincritical

Compromised PyPI/npm packages, typosquats, unsafe serialized models.

⚠ML02Data Poisoninghigh

Poisoned training datasets with triggers or anomalous distributions.

Static check covers trigger phrasing, PII and label skew; full poisoning detection is runtime.

•Prompt-injection phrasing — instruction-subversion language detected · PrefectHQ-marvin-7c3e20a/src/marvin/templates/system.jinja (CWE-77)expected

⚠ML09Output Integrityhigh

Middleware tampering with model outputs in transit.

Gateway enforces TLS + response integrity; static check flags output-rewriting code.

•Suspicious code patterns — OS command execution · PrefectHQ-marvin-7c3e20a/README.md (CWE-78)expected

•Suspicious code patterns — dynamic code execution · PrefectHQ-marvin-7c3e20a/examples/english_to_schema.py (CWE-95)expected

•Suspicious code patterns — destructive rm -rf /; pipe-to-shell install · PrefectHQ-marvin-7c3e20a/examples/slackbot/Dockerfile.slackbot (CWE-78)expected

•Suspicious code patterns — pipe-to-shell install · PrefectHQ-marvin-7c3e20a/examples/you_have_been_goosed/README.md (CWE-494)expected

§ML01Input Manipulation (Adversarial)Governance

Models vulnerable to adversarial perturbations.

Requires runtime robustness evaluation; addressed via publisher robustness attestation.

§ML03Model InversionGovernance

Training data reconstructable from a model's outputs.

Runtime/evaluation property; addressed via model-card data-provenance + DP attestation.

§ML04Membership InferenceGovernance

Determining whether a record was in the training set.

Runtime/evaluation property; addressed via overfitting disclosure + DP attestation.

§ML08Model SkewingGovernance

Models trained on skewed data producing biased output.

Requires fairness evaluation; addressed via model-card bias/limitations disclosure.

✓ML05Model TheftPassed

Unlicensed re-distribution / license-incompatible derivatives.

Static check verifies license declaration; extraction throttling is runtime.

✓ML07Transfer Learning AttackPassed

Backdoored base models / LoRA adapters propagating to derivatives.

Backdoor detection needs behavioral probing; static check covers unsafe serialization + provenance.

✓ML10Model Poisoning (Weights)Passed

Tampered model weight files; integrity must be verifiable.

Static check enforces safe formats + records a content hash for downstream verification.

Other findings (8) · hygiene / uncategorized

•Unrecognized file type — '.gitignore' is not on the allowlist · PrefectHQ-marvin-7c3e20a/.gitignorerisk surface

•Unrecognized file type — '.?' is not on the allowlist · PrefectHQ-marvin-7c3e20a/LICENSErisk surface

•Unrecognized file type — '.ini' is not on the allowlist · PrefectHQ-marvin-7c3e20a/alembic.inirisk surface

•Unrecognized file type — '.mdx' is not on the allowlist · PrefectHQ-marvin-7c3e20a/docs/api-reference/marvin-agents-actor.mdxrisk surface

•Unrecognized file type — '.dockerignore' is not on the allowlist · PrefectHQ-marvin-7c3e20a/examples/slackbot/.dockerignorerisk surface

•Unrecognized file type — '.slackbot' is not on the allowlist · PrefectHQ-marvin-7c3e20a/examples/slackbot/Dockerfile.slackbotrisk surface

•Unrecognized file type — '.mako' is not on the allowlist · PrefectHQ-marvin-7c3e20a/migrations/script.py.makorisk surface

•Unrecognized file type — '.jinja' is not on the allowlist · PrefectHQ-marvin-7c3e20a/src/marvin/templates/agent.jinjarisk surface

✔ verified source · pinned PrefectHQ-marvin-7c3e20a

Check against a policy

The same gate an agent runs before installing (POST /api/v1/trust/marvin-ai/check). Click a policy:

Consume Marvin programmatically. Authenticate with an API key or session — see Authorize an agent.

# Agents: CHECK BEFORE YOU INSTALL (no auth) — score, grade, level, capability manifest
curl https://ai-supply.store/api/v1/trust/marvin-ai

# Gate against your org policy (returns { pass, violations })
curl -X POST https://ai-supply.store/api/v1/trust/marvin-ai/check \
  -H "Content-Type: application/json" \
  -d '{"minGrade":"B","denyPermissions":["shell"],"denyUnknownEgress":true}'

# CLI
npx ai-supply add marvin-ai

# REST (install → download)
curl -X POST https://ai-supply.store/api/v1/listings/marvin-ai/install \
  -H "Authorization: Bearer $AIM_KEY"

# MCP tool
install_listing({ "slug": "marvin-ai" })

OpenAPI spec →