Workflow Node Risk Scanner

Create a human-review queue from node types and redacted parameters without executing the workflow.

Input and output

Input is a JSON workflow with nodes; output is PASS or REVIEW, finding severity, node names, and detected credential or executable indicators.

Execution and boundaries

Run python scripts/scan_node_risks.py --input examples/input.json --output examples/output.json. The scanner is static, does not resolve credentials, follow URLs, run code nodes, or make network requests.

Acceptance

The sample identifies a code or HTTP-like risk as REVIEW; a read-only sample with no findings returns PASS.