pipefy-process-impact
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the official
pipefyCLI to manage pipe data, retrieve automation lists, and query agent configurations. These commands are used legitimately to gather the necessary metrics for ROI calculations and process intelligence. - [SAFE]: All tools and resources identified are provided by the vendor (Pipefy). The skill follows platform best practices, such as prioritizing existing rules over AI agents and using correct UUID formats for agent discovery to avoid permission errors.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from card fields and report exports through
execute_graphqland pipe reports. While it lacks explicit boundary markers or sanitization, the risk is negligible as the data is used exclusively for date and duration arithmetic, with no capability for the data content to trigger shell commands or external network requests.
Audit Metadata