fern-workflows
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONNO_CODECREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official Fern resources including the
fern-api/setup-fern-cliandfern-api/sync-openapiGitHub Actions, as well as thefern-apiCLI package. These are trusted vendor-maintained tools required for the stated functionality. - [COMMAND_EXECUTION]: The documentation provides examples for executing standard CLI commands within automation scripts.
- Commands:
fern check,fern generate,fern upgrade. - [INDIRECT_PROMPT_INJECTION]: The skill describes workflows for processing external data such as OpenAPI specifications and documentation files.
- Ingestion points:
openapi.json,docs.ymlreferenced inreferences/spec-sync.mdandreferences/docs-workflows.md. - Capability inventory: Fern CLI's check and generate functions allow the processing of external content to produce SDKs and documentation sites.
- [NO_CODE]: The skill consists entirely of Markdown documentation and configuration references. It does not include executable scripts, binaries, or dynamic context injection patterns that run during the skill's load or activation process.
- [CREDENTIALS_UNSAFE]: The skill documents secure methods for handling sensitive data like
FERN_TOKENand registry secrets using environment variables and secret stores. It explicitly advises against insecure practices like echoing tokens or committing them to source control inreferences/validate-and-auth.md.
Audit Metadata