skills/agoodway/goodskills/pgflow/Gen Agent Trust Hub

pgflow

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes standard Elixir/Phoenix mix tasks for dependency management (mix deps.get), database migrations (mix ecto.migrate), and automated code generation (mix pgflow.gen.flow). These commands are standard for the development environment and are invoked to manage the workflow engine's infrastructure.
  • [DATA_EXPOSURE]: The debug subcommand is designed to query specific database tables within the pgflow and pgmq schemas to retrieve run statuses, execution timings, and error logs. These operations are scoped to workflow metadata and are intended for developer diagnostics within the local project environment.
  • [PERSISTENCE]: The skill facilitates the creation of scheduled recurring tasks using the pg_cron PostgreSQL extension when a cron attribute is defined in a flow or job module. This is a core functionality of the engine designed for legitimate scheduled workflow orchestration.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from the database (such as step error messages and historical outputs) to generate diagnostic reports. While this creates a surface where external data enters the agent's context, the interaction is localized to the developer's own database and is used for management and debugging purposes.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 10:46 AM
Security Audit — agent-trust-hub — pgflow