workflowy
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto interact with the Workflowy REST API. This is the intended primary purpose of the skill as specified in the documentation. Use ofcurlis necessary here as no native connector is provided. - [CREDENTIALS_SAFE]: The skill explicitly instructs against hardcoding the API key. It recommends reading the token from the
$WORKFLOWY_API_KEYenvironment variable or prompting the user at runtime, which is a standard and safe practice for secret management. - [DATA_EXPOSURE]: The skill interacts with the official
workflowy.comdomain. There are no patterns indicating data exfiltration to unauthorized third-party domains.
Audit Metadata