workflow
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides implementation patterns for a specific development framework (Convex). It references official developer components from the author's own ecosystem.
- [EXTERNAL_DOWNLOADS]: The skill references the
@convex-dev/workflowpackage. This is a developer-owned resource from the 'convex' organization and is categorized as a safe, standard dependency for this environment. - [COMMAND_EXECUTION]: Code examples demonstrate standard API calls within a TypeScript/JavaScript environment for managing workflows (e.g.,
workflow.start,step.runAction). These are confined to the framework's runtime and do not involve arbitrary shell command execution. - [INDIRECT_PROMPT_INJECTION]: While the workflow pattern handles external data (like a YouTube URL or user email), it provides a structured orchestration layer rather than a direct prompt interpolation surface. The skill recommends using internal actions for processing, which is a standard safety practice.
Audit Metadata