pflow-task-finish
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs its intended functions (git operations and task management) without any malicious patterns detected.
- [COMMAND_EXECUTION]: The script executes
gitandmdtodocommands. All user-supplied or data-derived arguments (like commit messages, slugs, and branch names) are properly quoted or processed through a slugification function before execution. - [EXTERNAL_DOWNLOADS]: The skill depends on a library script (
git-lib.sh) from a sibling skill (pflow-commit). This is a standard dependency within the agent skill ecosystem and does not involve downloading code from untrusted remote sources. - [DATA_EXFILTRATION]: The skill performs
git pushoperations to move code to remote repositories. This is the primary purpose of the skill and does not involve unauthorized data movement.
Audit Metadata