Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent automation-template generator, but users should review generated workflows carefully before connecting real credentials or production systems.
Before installing or using this skill, treat generated workflows as starter code: review every destination, test with non-production data, use platform secret managers or least-privilege credentials, and be careful with output files because the CLI may overwrite paths you provide.
The skill documents commands that retrieve, generate, and save workflow files, and it references repository paths such as templates/ and scripts/generator.py, implying file read/write behavior without declaring an explicit tool scope. That mismatch weakens least-privilege controls and can cause users or hosting systems to grant broader filesystem access than intended.
The skill promotes production-ready automations involving email, CRM sync, backups, webhooks, and API-driven workflows, but it omits safety guidance about privacy, credential handling, and side effects on external systems. Users may deploy templates that process personal or business data without understanding the risk of unauthorized disclosure, unintended messages, or destructive synchronization.
The listed templates include file backup, API sync, CRM sync, and webhook delivery patterns that can automatically copy, overwrite, or propagate data once enabled, yet no warning is given about these operational risks. In an automation-template context, this makes accidental bulk data movement or corruption more likely because users are encouraged to copy and activate workflows quickly.
The customization example shows secrets such as webhook URLs and API keys embedded directly in workflow variables without any warning about secret storage, repository commits, or log exposure. This is dangerous because users may copy credentials into files that are later shared, version-controlled, or imported into third-party automation platforms, leading to account compromise or unauthorized data access.
This code defines multiple templates that send webhook, CRM, Slack, email, Airtable, and Google Sheets data to external services, but the surrounding docstrings and inline documentation only describe setup steps and do not warn that user or system data may be transmitted off-platform. Under the code-file criteria, these network-transmitting operations lack disclosure beyond their functional names.
The get command writes template output directly to args.output, and only reports success after the write; there is no confirmation prompt, overwrite check, or warning that a local file will be created or replaced. The module usage text also does not disclose this file-writing behavior beyond showing an example command.
The generate command saves workflow content directly to the path provided by --output, but does not disclose overwrite risk or request confirmation before modifying the filesystem. This is a file-write operation lacking any preventative prompt or explicit warning.
No suspicious patterns detected.
