skills/camunda/skills/camunda-c8ctl/Gen Agent Trust Hub

camunda-c8ctl

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses standard shell commands and the c8ctl CLI to manage local development environments and Camunda 8 clusters. It provides clear instructions for installing the CLI via npm and monitoring process instances.
  • [CREDENTIALS_SAFE]: The skill follows security best practices by instructing users to manage secrets in a .env file that should be excluded from version control via .gitignore. It explicitly warns the agent (and user) to never read or commit the real secrets file, only example placeholders.
  • [EXTERNAL_DOWNLOADS]: The skill triggers the download of the c8run binary from Camunda's official infrastructure. Use of official vendor resources from the author's own domain is legitimate functionality for an installation skill.
  • [REMOTE_CODE_EXECUTION]: While it involves downloading and running an executable (c8run), the source is the official Camunda Download Center, which aligns with the skill's purpose as a vendor tool. It does not use unsafe piped execution (curl|bash).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 06:11 PM
Security Audit — agent-trust-hub — camunda-c8ctl