cpf-workflow-author

Pass

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses cpf guide, cpf validate, cpf run, and cpf resume to manage workflows. These are expected behaviors for a skill dedicated to authoring workflows for the 'cpf' tool.
  • [COMMAND_EXECUTION]: The documentation describes a cli step kind that allows execution of arbitrary shell commands. While powerful, this is the core intended functionality of a workflow automation tool and is mediated by the user defining the YAML file.
  • [EXTERNAL_DOWNLOADS]: The skill documentation mentions an api step kind for making HTTP requests. This is a standard automation feature and is presented as a capability for the user to configure in their workflows, not as a background action of the skill itself.
  • [DATA_EXFILTRATION]: No patterns of sensitive data access or exfiltration to non-whitelisted domains were found. Operations are restricted to local file paths and the user-specified workflow destinations.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 21, 2026, 09:53 PM
Security Audit — agent-trust-hub — cpf-workflow-author