workflows-doctor
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local diagnostic commands including
zapier-sdk --versionandnpm view. It also uses a helper script to maintain skill freshness via the standardnpx skills updateutility. - [EXTERNAL_DOWNLOADS]: The skill manages updates for the Zapier SDK CLI and related workflow skills. These downloads are performed through official channels (
npm install -g @zapier/zapier-sdk-cli@latest) and the vendor's canonical GitHub repository (zapier/agent-skills), which are trusted vendor resources. - [SAFE]: Security-sensitive operations like global package installation are accompanied by warnings to avoid
sudoin favor of user-owned Node installations (likenvmor Homebrew), which is a recommended security best practice. The self-update mechanism (scripts/skill-freshness-check.sh) uses local state markers to prevent excessive network calls and ensures that updates only proceed through the official skills CLI.
Audit Metadata