pipefy-attachments
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill references the
pipefyCLI tool as an alternative to MCP tools for performing file uploads. This is a standard vendor-provided utility. - [DATA_EXFILTRATION]: The skill's primary purpose is to read local files and upload them to Pipefy's storage infrastructure (AWS S3) using presigned URLs. The analysis confirms this behavior is consistent with the skill's stated purpose and targets the vendor's own service.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts a
file_pathargument to identify files for upload. While this provides a surface for potential path manipulation if the agent processes untrusted input, the skill includes validation steps for file existence, type, and size (100 MiB limit).
Audit Metadata