bpmn
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or data exfiltration attempts were detected. The skill's scripts follow best practices for processing XML data and managing local files.
- [EXTERNAL_DOWNLOADS]: The skill requires a one-time installation of dependencies (
bpmn-moddleandbpmn-auto-layout) via npm. These are established, widely-used libraries from the BPMN.io / Camunda ecosystem and are considered trusted sources for BPMN processing. - [COMMAND_EXECUTION]: The bundled Node.js CLI tool (
bpmn-tool.mjs) performs deterministic operations such as layout generation and linting. It operates on local files provided as command-line arguments and does not execute arbitrary shell commands or untrusted code.
Audit Metadata