pipefy-attachments

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill references the pipefy CLI tool as an alternative to MCP tools for performing file uploads. This is a standard vendor-provided utility.
  • [DATA_EXFILTRATION]: The skill's primary purpose is to read local files and upload them to Pipefy's storage infrastructure (AWS S3) using presigned URLs. The analysis confirms this behavior is consistent with the skill's stated purpose and targets the vendor's own service.
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts a file_path argument to identify files for upload. While this provides a surface for potential path manipulation if the agent processes untrusted input, the skill includes validation steps for file existence, type, and size (100 MiB limit).
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 01:08 AM
Security Audit — agent-trust-hub — pipefy-attachments