webflow-cli:cloud
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the
@webflow/webflow-clitool via standard package managers (NPM, Yarn, Pnpm). It also downloads project templates from theWebflow-Examplesorganization on GitHub during thecloud initprocess. These are official resources provided by the vendor. - [COMMAND_EXECUTION]: The skill uses a bash shell to execute
webflowCLI commands for project management and deployment, as well asgitcommands for version control integration. These operations are within the scope of the skill's documented purpose. - [INDIRECT_PROMPT_INJECTION]: The agent is instructed to read local configuration files like
webflow.jsonandpackage.jsonto determine framework types and project IDs. - Ingestion points: Reads
webflow.jsonandpackage.jsonfrom the local file system. - Boundary markers: None explicitly defined for file reads, though data is treated as structured JSON.
- Capability inventory: Uses the bash tool to execute deployment and initialization commands.
- Sanitization: No specific sanitization is mentioned for the values read from the JSON manifests, though the CLI itself performs validation on these inputs.
Audit Metadata