workflows-doctor

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is designed for maintenance and diagnostics of Zapier's own workflow toolset.
  • [COMMAND_EXECUTION]: The skill uses standard CLI tools (npm, npx, zapier-sdk) to check versions and update packages. These commands are restricted to the official @zapier/zapier-sdk-cli and the zapier/agent-skills repository.
  • [EXTERNAL_DOWNLOADS]: The skill fetches updates using npx skills update and npx skills add zapier/agent-skills. These target the vendor's own official GitHub organization and public registries, which is expected behavior for a diagnostic/update utility.
  • [NO_CODE]: The shell script skill-freshness-check.sh implements local throttling logic to avoid excessive update checks. It uses standard bash utilities (cksum, find, date) to determine if an update is due and if the local skill files have changed on disk. No malicious obfuscation or data exfiltration patterns were detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 09:17 AM
Security Audit — agent-trust-hub — workflows-doctor