workflow
Provides expert guidance for building durable workflows and long-running tasks using Vercel Workflow DevKit.
Install this skill
Security score
The workflow skill was audited on May 15, 2026 and we found 36 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 519 | const response = await fetch(`https://api.example.com/users/${userId}`); |
Template literal with variable interpolation in command context
| 528 | prompt: `Process: ${JSON.stringify(data)}`, |
Template literal with variable interpolation in command context
| 580 | return `Results for "${query}"`; |
Template literal with variable interpolation in command context
| 687 | token: `chat-${channelId}`, |
Template literal with variable interpolation in command context
| 719 | throw new FatalError(`Client error: ${res.status}`); |
Template literal with variable interpolation in command context
| 829 | await logInfo(`Starting task: ${task}`); |
Webhook reference - potential data exfiltration
| 133 | - "webhook callback" |
Webhook reference - potential data exfiltration
| 149 | - "webhook chain" |
Webhook reference - potential data exfiltration
| 150 | - "webhook pipeline" |
Webhook reference - potential data exfiltration
| 151 | - "webhook orchestration" |
Webhook reference - potential data exfiltration
| 173 | - "wait for webhook" |
Webhook reference - potential data exfiltration
| 177 | - "orchestrate webhooks" |
Webhook reference - potential data exfiltration
| 261 | - [chain, webhook] |
Webhook reference - potential data exfiltration
| 268 | - [sequential, webhook] |
Webhook reference - potential data exfiltration
| 273 | - [webhook, chain] |
Webhook reference - potential data exfiltration
| 274 | - [webhook, orchestrat] |
Webhook reference - potential data exfiltration
| 275 | - [webhook, pipeline] |
Webhook reference - potential data exfiltration
| 276 | - [webhook, sequential] |
Webhook reference - potential data exfiltration
| 289 | - [wait, webhook] |
Webhook reference - potential data exfiltration
| 335 | - "webhook" |
Webhook reference - potential data exfiltration
| 494 | import { sleep, fetch, createHook, createWebhook, getWritable } from "workflow"; |
Webhook reference - potential data exfiltration
| 499 | import { start, getRun, resumeHook, resumeWebhook } from "workflow/api"; |
Webhook reference - potential data exfiltration
| 657 | Hooks let workflows wait for external data. Use `createHook()` inside a workflow and `resumeHook()` from API routes. Deterministic tokens are for `createHook()` + `resumeHook()` (server-side) only. `c |
Webhook reference - potential data exfiltration
| 927 | **Integration testing:** Use `@workflow/vitest` for workflows using `sleep()`, hooks, webhooks, or retries: |
Webhook reference - potential data exfiltration
| 968 | **Testing webhooks:** Use `resumeWebhook()` with a `Request` object — no HTTP server needed: |
Webhook reference - potential data exfiltration
| 971 | import { start, resumeWebhook } from "workflow/api"; |
Webhook reference - potential data exfiltration
| 975 | const hook = await waitForHook(run); // Discovers the random webhook token |
Webhook reference - potential data exfiltration
| 976 | await resumeWebhook(hook.token, new Request("https://example.com/webhook", { |
Webhook reference - potential data exfiltration
| 986 | - `resumeHook(token, data)` / `resumeWebhook(token, request)` — resume paused workflows |
Access to .env file
| 418 | pattern: 'process\.env\.(OPENAI_API_KEY|ANTHROPIC_API_KEY)|from\s+[''"]@ai-sdk/(anthropic|openai)[''""]' |
External URL reference
| 7 | - "https://vercel.com/docs/workflow" |
External URL reference
| 8 | - "https://useworkflow.dev" |
External URL reference
| 9 | sitemap: "https://vercel.com/sitemap/docs.xml" |
External URL reference
| 478 | - **Website**: https://useworkflow.dev |
External URL reference
| 519 | const response = await fetch(`https://api.example.com/users/${userId}`); |
External URL reference
| 976 | await resumeWebhook(hook.token, new Request("https://example.com/webhook", { |