cpf-workflow-author
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
cpf guide,cpf validate,cpf run, andcpf resumeto manage workflows. These are expected behaviors for a skill dedicated to authoring workflows for the 'cpf' tool. - [COMMAND_EXECUTION]: The documentation describes a
clistep kind that allows execution of arbitrary shell commands. While powerful, this is the core intended functionality of a workflow automation tool and is mediated by the user defining the YAML file. - [EXTERNAL_DOWNLOADS]: The skill documentation mentions an
apistep kind for making HTTP requests. This is a standard automation feature and is presented as a capability for the user to configure in their workflows, not as a background action of the skill itself. - [DATA_EXFILTRATION]: No patterns of sensitive data access or exfiltration to non-whitelisted domains were found. Operations are restricted to local file paths and the user-specified workflow destinations.
Audit Metadata