pgflow
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard Elixir/Phoenix
mixtasks for dependency management (mix deps.get), database migrations (mix ecto.migrate), and automated code generation (mix pgflow.gen.flow). These commands are standard for the development environment and are invoked to manage the workflow engine's infrastructure. - [DATA_EXPOSURE]: The
debugsubcommand is designed to query specific database tables within thepgflowandpgmqschemas to retrieve run statuses, execution timings, and error logs. These operations are scoped to workflow metadata and are intended for developer diagnostics within the local project environment. - [PERSISTENCE]: The skill facilitates the creation of scheduled recurring tasks using the
pg_cronPostgreSQL extension when acronattribute is defined in a flow or job module. This is a core functionality of the engine designed for legitimate scheduled workflow orchestration. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the database (such as step error messages and historical outputs) to generate diagnostic reports. While this creates a surface where external data enters the agent's context, the interaction is localized to the developer's own database and is used for management and debugging purposes.
Audit Metadata