workflows-doctor
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed for maintenance and diagnostics of Zapier's own workflow toolset.
- [COMMAND_EXECUTION]: The skill uses standard CLI tools (
npm,npx,zapier-sdk) to check versions and update packages. These commands are restricted to the official@zapier/zapier-sdk-cliand thezapier/agent-skillsrepository. - [EXTERNAL_DOWNLOADS]: The skill fetches updates using
npx skills updateandnpx skills add zapier/agent-skills. These target the vendor's own official GitHub organization and public registries, which is expected behavior for a diagnostic/update utility. - [NO_CODE]: The shell script
skill-freshness-check.shimplements local throttling logic to avoid excessive update checks. It uses standard bash utilities (cksum,find,date) to determine if an update is due and if the local skill files have changed on disk. No malicious obfuscation or data exfiltration patterns were detected.
Audit Metadata