workflow-builder
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a set of Python-based utilities (
workflow_intake.py,scaffold_workflow.py,validate_workflow.py) designed to assist in the creation of JavaScript workflow files. These scripts operate purely on locally provided parameters or file paths and do not perform any remote code execution or network operations. - [SAFE]: The
validate_workflow.pyscript specifically enforces security and reliability constraints for the Claude Code Workflow environment, such as banning non-deterministic functions (Math.random,Date.now) and blocking access to potentially dangerous Node.js APIs (fs,require,process,fetch) within the orchestrator layer. - [SAFE]: All templates and examples (
assets/templates/,assets/examples/) demonstrate best practices for token management usingbudget.remaining()guards and structured output via JSON Schema, which reduces the risk of accidental resource exhaustion or malformed data processing. - [SAFE]: The skill uses clear, non-negotiable intake instructions to ensure the AI agent understands the user's requirements before generating any code, serving as a functional guardrail against vague or unsafe automation requests.
Audit Metadata